World of Warcraft: one simple line of code can cost you dearly

Re:World of Warcraft: one simple line of code can cost you d... by eridius on Monday July 25, 2016 @01:49PM (#12160271)

> A better fix is to prevent rebinding the 'RunScript' function to some other name

Breaking a huge number of addons in the process, for literally no benefit because the attacker can just use that other name.

> and to prevent rebinding the 'RemoveExtraSpaces' function by anything else

Which wouldn't really solve anything because the attacker can just find some other function that is regularly executed with attacker-supplied input and use that instead.

[ Parent | on HN ]

Re:World of Warcraft: one simple line of code can cost you d... by tomc1985 on Monday July 25, 2016 @04:17PM (#12161302)

No, a better fix is to remove the ability to re-bind ALL functions, or at least system calls. How is function-hotswapping-bullshit permissible in an untrusted environment?

[ Parent | on HN ]

Re:World of Warcraft: one simple line of code can cost you d... by cheald on Monday July 25, 2016 @04:44PM (#12161491)

There isn't really a good way to prevent reassignment of first-class functions to new names in Lua.

[ Parent | on HN ]

Re:World of Warcraft: one simple line of code can cost you d... by tomc1985 on Monday July 25, 2016 @05:15PM (#12161662)

So it seems.

[ Parent | on HN ]

Re:World of Warcraft: one simple line of code can cost you d... by nitrogen on Monday July 25, 2016 @04:27PM (#12161377)

That's how Lua works. It would be prudent, but difficult to change.

[ Parent | on HN ]