ModSecurity
| Kind | class |
| Package | backend |
| Full name | backend.ModSecurity |
| Source | source/backend/ModSecurity.hx |
| Metadata | @:unreflective |
Public fields
| Name | Type | Static | Default | Notes |
|---|---|---|---|---|
LOOSE_MOD_NAME | String | yes | '<loose mods>' | final |
Public methods
checkScript
static function checkScript(scriptName:String, source:String, language:String):ModSecurityCheck
Inspect one script. Findings mean the caller must not create/execute it.
| Parameter | Type | Default |
|---|---|---|
scriptName | String | — |
source | String | — |
language | String | — |
report
static function report(check:ModSecurityCheck, ?sink:String->Void):Void
Emit the user-facing warning/block report. sink is normally the
PlayState debug console; trace output is always produced as a durable log.
| Parameter | Type | Default |
|---|---|---|
check | ModSecurityCheck | — |
sink (optional) | String->Void | — |
formatRuntimeBlock
static function formatRuntimeBlock(modName:String, scriptName:String, capability:String, line:Int = 0):String
| Parameter | Type | Default |
|---|---|---|
modName | String | — |
scriptName | String | — |
capability | String | — |
line (optional) | Int | 0 |
runtimeRuleForCallback
static function runtimeRuleForCallback(callbackName:String):Null<String>
| Parameter | Type | Default |
|---|---|---|
callbackName | String | — |
isRuleAllowed
static inline function isRuleAllowed(rule:String, allowlist:Array<String>):Bool
| Parameter | Type | Default |
|---|---|---|
rule | String | — |
allowlist | Array<String> | — |
isRuntimeCallbackBlocked
static function isRuntimeCallbackBlocked(callbackName:String, sandboxed:Bool, allowlist:Array<String>):Bool
| Parameter | Type | Default |
|---|---|---|
callbackName | String | — |
sandboxed | Bool | — |
allowlist | Array<String> | — |
isPrivilegedClass
static function isPrivilegedClass(className:String):Bool
Classes that reflection callbacks must never expose to sandboxed mods.
| Parameter | Type | Default |
|---|---|---|
className | String | — |
luaBootstrap
static function luaBootstrap(allowlist:Array<String>):String
Lua code installed immediately after openlibs(). Each non-allowlisted standard-library category becomes a sealed proxy whose calls fail before reaching LuaJIT/FFI/OS code. package.loaded is replaced too so require() cannot recover a reference after only one category was allowlisted.
| Parameter | Type | Default |
|---|---|---|
allowlist | Array<String> | — |
clearCache
static function clearCache():Void
Drop cached pack.json decisions (mainly useful after an in-process reload).
Internals
Private / internal members
| Field | Type | Static |
|---|---|---|
BLOCKED_CALLBACK_RULES | Map<String, String> | yes |
configCache | Map<String, ModSandboxConfig> | yes |
warnedOptOutMods | Map<String, Bool> | yes |
| Method |
|---|
static function getConfig(folder:Null<String>):ModSandboxConfig |
static function appendAllowlist(output:Array<String>, raw:Dynamic):Void |
static function mergeFindings(output:Array<ScriptSecurityFinding>, extra:Array<ScriptSecurityFinding>):Void |
static function findModOwner(path:String) |
static function normalizePath(path:String):String |
static function displayPath(path:String, folder:Null<String>):String |
static function emit(message:String, sink:Null<String->Void>):Void |