YarnSpinnerTool / YarnSpinner

Yarn Spinner is a tool for building interactive dialogue in games!
https://yarnspinner.dev
MIT License
2.3k stars 201 forks source link

It is possible to sneak empty or whitespace-only commands past the compiler #362

Closed janhohenheim closed 12 months ago

janhohenheim commented 1 year ago

What is the current behavior?

<<>> does not compile: "Command text expected" however, the following does compile: <<{0}{""}>> and evaluates to <<>>, which can easily be verified on https://try.yarnspinner.dev/

What is the expected behavior?

Ideally, the {0} should not be usable to trick evaluations. One can generally do some very weird stuff with it, e.g. {0} {1} becomes 1 1.

Please tell us about your environment:

Other information

This does not matter that much, since it's quite a weird usage, but I discovered it while porting the command parsing code to yarn_slinger where I was wondering if it was possible to have a command without at least a name. Turns out that yes, with this hack here, it is possible! I haven't checked this out in Unity, but I suspect the following error would be triggered: https://github.com/YarnSpinnerTool/YarnSpinner-Unity/blob/5944b0e03d319303cd185b08140772a5804a2762/Runtime/DialogueRunner.cs#L867, which would not help the user much.