ScriptSecurityScanner

Kind	class
Package	backend
Full name	backend.ScriptSecurityScanner
Source	source/backend/ScriptSecurityScanner.hx

Dependency-free source scanner used by ModSecurity.

This is deliberately separate from the game/runtime integration so its matching and line-number behaviour can be tested with plain haxe --interp. It is one layer of the sandbox, not a claim that text matching alone is a security boundary; Lua library replacement and interpreter restrictions are applied by ModSecurity's runtime integration as well.

Public fields

Name	Type	Static	Default	Notes
LUA_RULES	Array<ScriptSecurityRule>	yes	[	final
PYTHON_RULES	Array<ScriptSecurityRule>	yes	[	final
HAXE_RULES	Array<ScriptSecurityRule>	yes	[	final
COMMON_RULES	Array<ScriptSecurityRule>	yes	[	final

Public methods

scan

static function scan(source:String, language:String, ?allowlist:Array<String>):Array<ScriptSecurityFinding>

Scan source and return every non-allowlisted finding with one-based lines. language is lua, python, or haxe (aliases py, hx, and hscript are accepted). Comment-only lines are ignored so documentation does not disable a mod; suspicious strings on executable lines are not.

Parameter	Type	Default
source	String	—
language	String	—
allowlist (optional)	Array<String>	—

View source

isAllowed

static function isAllowed(rule:String, allowlist:Array<String>):Bool

Parameter	Type	Default
rule	String	—
allowlist	Array<String>	—

View source

descriptionFor

static function descriptionFor(ruleId:String):String

Parameter	Type	Default
ruleId	String	—

View source

Internals

Private / internal members

Method
static function matchRules(line:String, lineNumber:Int, rules:Array<ScriptSecurityRule>, allowlist:Array<String>, findings:Array<ScriptSecurityFinding>):Void
static function isCommentOnly(line:String, language:String):Bool
static function trimSnippet(line:String):String