Skip to content

Tooltip taint trapping#142

Open
RedAntisocial wants to merge 1 commit into
astralguild:mainfrom
RedAntisocial:main
Open

Tooltip taint trapping#142
RedAntisocial wants to merge 1 commit into
astralguild:mainfrom
RedAntisocial:main

Conversation

@RedAntisocial

Copy link
Copy Markdown

Updated and trapped out (via early exit) tooltip taint on Forces % against secret values.

Updated and trapped out (via early exit) tooltip taint on Forces % against secret values.
@Kyylier

Kyylier commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

Thanks for the PR! Sorry for the delayed response ...

Do you have context for this change, e.g. stacktrace or error from the taint?
I assume that data is secret sometimes? Would an initial canaccessvalue(data) check suffice instead of polling GetUnit() then UnitGUID()?

@RedAntisocial

RedAntisocial commented Jun 22, 2026

Copy link
Copy Markdown
Author

My apologies. I should have included that here. Luckily I still have it in my notes, so I've put it below. It should help clear up why I used GetUnit() and UnitGUID() checks instead of canAccessValue(). That was my first approach, but I couldn't get it to reliably work.

It would work in some cases, but in others I'd still get errors. Likely because canAccessValue() expects data.guid to have a value in the callback, which it won't if the cursor isn't over a player. I could have trapped it out there using much the same method as I have here, by checking GetUnit() and UnitGUID(), but then, why not just trap it out that way first? Checking for GetUnit() and UnitGUID() and exiting early was the cleanest fix I could find.

2771x attempt to perform string conversion on a secret string value (execution tainted by 'AstralKeys')

[AstralKeys/Forces.lua]:8: in function <AstralKeys/Forces.lua:3>
[tail call]: ?
[C]: in function 'securecallfunction'
[Blizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua]:67: in function <...lizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua:62>
[Blizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua]:87: in function <...lizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua:83>
[Blizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua]:123: in function <...lizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua:113>
[C]: in function 'SetAttribute'
[Blizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua]:148: in function <...lizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua:141>
[Blizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua]:298: in function <...lizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua:245>
[C]: in function 'securecallfunction'
[Blizzard_SharedXMLGame/Tooltip/TooltipDataHandler.lua]:242: in function 'ProcessInfo'
[Blizzard_GameTooltip/Mainline/GameTooltip.lua]:997: in function 'SetWorldCursor'
[Blizzard_UIParent/Mainline/UIParent.lua]:1274: in function <...rfaceBlizzard_UIParent/Mainline/UIParent.lua:1194>
Locals:
tooltip=GameTooltip GameTooltip.xml:249{
ItemTooltip=Frame GameTooltip.xml:254
BottomOverlay=Texture SharedTooltipTemplates.xml:28
NineSlice=Frame SharedTooltipTemplates.xml:19
suppressAutomaticCompareItem=false
textLeft1Font="GameTooltipHeaderText"
textRight2Font="GameTooltipText"
TopOverlay=Texture SharedTooltipTemplates.xml:23
TextLeft1=GameTooltipTextLeft1 SharedTooltipTemplates.xml:35
processingInfo=


infoList=

supportsDataRefresh=true
shouldRefreshData=false
waitingForData=false
shoppingTooltips=

updateTooltipTimer=0.003000
StatusBar=GameTooltipStatusBar GameTooltip.xml:9
supportsItemComparison=true
TextRight1=GameTooltipTextRight1 SharedTooltipTemplates.xml:36
textLeft2Font="GameTooltipText"
layoutType="TooltipDefaultLayout"
textRight1Font="GameTooltipHeaderText"
TextRight2=GameTooltipTextRight2 SharedTooltipTemplates.xml:42
TextLeft2=GameTooltipTextLeft2 SharedTooltipTemplates.xml:41
}
data=
{
dataInstanceID=2421
type=2
guid=
lines=

healthGUID=
}
(*temporary)=6
addon=
{
modules=

EXPANSION_LEVEL=30
Week=459
NUM_AFFIXES=5
L=

Debug=false
MYTHICKEY_CITY_NPCID=197711
baseName="AstralKeys"
icon=

MYTHICKEY_ITEMID=180653
refreshTime=0
FACTION=1
KEYS_TEXT_COMMAND="!keys"
inKey=true
CLIENT_VERSION="4.53"
db=

defaultModuleState=true
enabledState=true
defaultModuleLibraries=

keystone=

MYTHICKEY_REROLL_NPCID=197915
orderedModules=

name="AstralKeys"
TIMEWALKINGKEY_ITEMID=187786
UPDATE_VERSION="updateV9"
refreshKeystoneAfterCombat=false
}

@RedAntisocial

Copy link
Copy Markdown
Author

Updated my comment to use a quote block instead of a code block for the sake of formatting and readability

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants