Re:World of Warcraft: one simple line of code can cost you d...
by niftich on Monday July 25, 2016 @05:12PM
(#12161650)
The assumption is that a proper mitigation would result in the script console being in a separate execution context; such that variables that are (re-)declared in the script console would not affect the chat console's context, or its 'RemoveExtraSpaces' function, nor the global context. I should've been more clear.
Re:World of Warcraft: one simple line of code can cost you d...
by eridius on Monday July 25, 2016 @07:07PM
(#12162250)
That assumption wouldn't work. If the script console is a separate Lua environment, it's completely useless. As long as it's the same environment that the rest of the game/addons use (which it must be), then there's no "mitigation" that can be done like you're hoping for.
The attacker is executing script through the RemoveExtraSpaces function that gets run on every chat message, not by executing it with either player's chat console.