Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CLEANUP + ENHANCEMENT] rework polymod buildImports #4219

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
+88 −70
Open

[CLEANUP + ENHANCEMENT] rework polymod buildImports #4219

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0fad14d
rework buildImports
cyn0x8 Feb 24, 2025
6b6a7a0
Update PolymodHandler.hx
cyn0x8 Feb 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
158 changes: 88 additions & 70 deletions source/funkin/modding/PolymodHandler.hx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,82 +237,100 @@ class PolymodHandler
static function buildImports():Void
{
// Add default imports for common classes.
Polymod.addDefaultImport(funkin.Assets);
Polymod.addDefaultImport(funkin.Paths);
final defaultImports:Array<Class<Dynamic>> = [
flixel.FlxG,

funkin.Assets,
funkin.Conductor,
funkin.Paths,
funkin.modding.module.ModuleHandler,
funkin.play.PlayState,
];

// Add import aliases for certain classes.
// NOTE: Scripted classes are automatically aliased to their parent class.
Polymod.addImportAlias('flixel.math.FlxPoint', flixel.math.FlxPoint.FlxBasePoint);

Polymod.addImportAlias('funkin.data.event.SongEventSchema', funkin.data.event.SongEventSchema.SongEventSchemaRaw);

// `lime.utils.Assets` literally just has a private `resolveClass` function for some reason? so we replace it with our own.
Polymod.addImportAlias('lime.utils.Assets', funkin.Assets);
Polymod.addImportAlias('openfl.utils.Assets', funkin.Assets);

// Add blacklisting for prohibited classes and packages.

// `Sys`
// Sys.command() can run malicious processes
Polymod.blacklistImport('Sys');

// `Reflect`
// Reflect.callMethod() can access blacklisted packages
Polymod.blacklistImport('Reflect');

// `Type`
// Type.createInstance(Type.resolveClass()) can access blacklisted packages
Polymod.blacklistImport('Type');

// `cpp.Lib`
// Lib.load() can load malicious DLLs
Polymod.blacklistImport('cpp.Lib');

// `Unserializer`
// Unserializer.DEFAULT_RESOLVER.resolveClass() can access blacklisted packages
Polymod.blacklistImport('Unserializer');

// `lime.system.CFFI`
// Can load and execute compiled binaries.
Polymod.blacklistImport('lime.system.CFFI');

// `lime.system.JNI`
// Can load and execute compiled binaries.
Polymod.blacklistImport('lime.system.JNI');

// `lime.system.System`
// System.load() can load malicious DLLs
Polymod.blacklistImport('lime.system.System');

// `lime.utils.Assets`
// Literally just has a private `resolveClass` function for some reason?
Polymod.blacklistImport('lime.utils.Assets');
Polymod.blacklistImport('openfl.utils.Assets');
Polymod.blacklistImport('openfl.Lib');
Polymod.blacklistImport('openfl.system.ApplicationDomain');
Polymod.blacklistImport('openfl.net.SharedObject');

// `openfl.desktop.NativeProcess`
// Can load native processes on the host operating system.
Polymod.blacklistImport('openfl.desktop.NativeProcess');

// `polymod.*`
// Contains functions which may allow for un-blacklisting other modules.
for (cls in ClassMacro.listClassesInPackage('polymod'))
final importAliases:Map<String, Class<Dynamic>> = [
"flixel.math.FlxPoint" => flixel.math.FlxPoint.FlxBasePoint,

"funkin.data.event.SongEventSchema" => funkin.data.event.SongEventSchema.SongEventSchemaRaw,

// `lime.utils.Assets` literally just has a private `resolveClass` function for some reason? so we replace it with our own.
"lime.utils.Assets" => funkin.Assets,
"openfl.utils.Assets" => funkin.Assets
];

// Add blacklisting for prohibited classes.
final importBlacklist:Array<String> = [
// `Sys`
// Sys.command() can run malicious processes
'Sys',

// `Reflect`
// Reflect.callMethod() can access blacklisted packages
'Reflect',

// `Type`
// Type.createInstance(Type.resolveClass()) can access blacklisted packages
'Type',

// `cpp.Lib`
// Lib.load() can load malicious DLLs
'cpp.Lib',

// `Unserializer`
// Unserializer.DEFAULT_RESOLVER.resolveClass() can access blacklisted packages
'Unserializer',

// `lime.system.CFFI`
// Can load and execute compiled binaries.
'lime.system.CFFI',

// `lime.system.JNI`
// Can load and execute compiled binaries.
'lime.system.JNI',

// `lime.system.System`
// System.load() can load malicious DLLs
'lime.system.System',

// `lime.utils.Assets`
// Literally just has a private `resolveClass` function for some reason?
'lime.utils.Assets',
'openfl.utils.Assets',
'openfl.Lib',
'openfl.system.ApplicationDomain',
'openfl.net.SharedObject',

// `openfl.desktop.NativeProcess`
// Can load native processes on the host operating system.
'openfl.desktop.NativeProcess',

// Access to the file system.
'sys.FileSystem'
];

// Add blacklisting for prohibited packages.
final importBlacklistPackages:Array<String> = [
// Contains functions which may allow for un-blacklisting other modules.
'polymod',

// Access to the file system as well as `Process` which can run malicious processes
'sys.io'
];

for (packageName in importBlacklistPackages)
{
if (cls == null) continue;
var className:String = Type.getClassName(cls);
Polymod.blacklistImport(className);
for (cls in ClassMacro.listClassesInPackage(packageName, true))
{
if (cls == null) continue;
importBlacklist.push(Type.getClassName(cls));
}
}

// `sys.*`
// Access to system utilities such as the file system.
for (cls in ClassMacro.listClassesInPackage('sys'))
{
if (cls == null) continue;
var className:String = Type.getClassName(cls);
Polymod.blacklistImport(className);
}
// apply to Polymod
for (className in defaultImports) Polymod.addDefaultImport(className);
for (className in importAliases.keys()) Polymod.addImportAlias(className, importAliases.get(className));
for (className in importBlacklist) Polymod.blacklistImport(className);
}

static function buildParseRules():polymod.format.ParseRules
Expand Down
Loading