hexcede / h6x Goto Github PK
View Code? Open in Web Editor NEWA script sandboxing tool for Roblox, oriented for security and compatability.
Home Page: https://discord.gg/RCeqSZBBQJ
License: MIT License
A script sandboxing tool for Roblox, oriented for security and compatability.
Home Page: https://discord.gg/RCeqSZBBQJ
License: MIT License
This is an example of how you might word or structure a code compatability issue. You don't have to do it exactly this way but it's helpful. This was a real bug encountered in-dev before the release of v1.1.220607
.
Describe the bug
This code causes H6x to hang Roblox.
To Reproduce
When the code runs, sandbox:GenerateActivityReport
causes a hang.
This code demonstrates the issue as best as possible and is as small as possible:
local sandbox = H6x.Sandbox.new()
sandbox:ExecuteFunction(function()
abc = function(a, b)
return b, a
end
b, a = abc({ABC = abc}, 2)
a.ABC(4, 5)
a:ABC(8)
end)
sandbox:GenerateActivityReport("h6x") -- Caused by this (commenting this line makes the code work)
Expected behavior
The code runs correctly without hanging.
This code demonstrates the expected behaviour when ran outside of the sandbox (leave unchanged if N/A):
CODE HERE
Version information (please complete the following information):
v1.1.220607
Additional context
After investigating the issue and debugging it myself, the hang is caused by a table.find
call inside of sandbox:GenerateActivityReport()
. table.find
does regular ==
comparison, which causes a new log entry to be created before sandbox:GenerateActivityReport()
is finished, resulting in the pairs
loop on log history to never complete.
Describe the bug
Calling a user data object with the metamethod __call
fails to check whether it's a C function, results in an error using debug.info with argument 1.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
Calling it must not encounter an issue with user data
Version information:
Describe the bug
As demonstrated in #8 globals from tests end up in the base environment the sandbox uses. This is not necessarily a security concern but is potentially confusing behaviour as it is the default and providing custom base environments is not super clear.
To Reproduce
Steps to reproduce the behavior:
print(getfenv(2))
Expected behavior
By default, writing to the global environment from a sandbox would not be expected to modify the base environment. This can be solved by using another layer for the Environment
object for storing raw changes, rather than transferring them to the base environment.
Version information (please complete the following information):
v0.0.x
-v1.x.x
Additional context
See #8
There's a vulnerability inside user code where it can mess with the global H6X.
Reproducing the bug
warn(getfenv(2))
Expected behavior
Prints out the global H6x table
FX Script 327713710-734a0c06164e71: ▼ {
["globalH6x"] = ▼ {
["Constants"] = ▶ {...},
["Environment"] = ▶ {...},
["Logger"] = ▶ {...},
["Reflector"] = ▶ {...},
["Runner"] = ▶ {...},
["Sandbox"] = ▼ {
["Empty"] = ▶ {...},
["Plugin"] = ▶ {...},
["Roblox"] = ▶ {...},
["User"] = ▶ {...},
["Vanilla"] = ▶ {...},
["new"] = "function"
},
["SandboxActivity"] = ▶ {...},
["Testing"] = ▶ {...},
["Util"] = ▶ {...}
},
["globalSandbox"] = ▶ {...},
["globalThing"] = "someNotVerySpecificString",
["script"] = Sandbox,
["testMulti"] = "function",
["thread"] = "Thread(24B3FD890F8)"
}
Version information (please complete the following information):
Additional context
I wasn't sure if this bug was necessary or not in terms of allowing user code to access the global H6X table. I wanted to point this out because it could access H6X module and possibly tamper its functions.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.