Merge pull request #3558 from FunkinCrew/bugfix/appdomain-blacklist-2

Blacklist two additional Polymod classes
This commit is contained in:
Eric
2024-10-03 17:38:31 -04:00
committed by GitHub
+7
View File
@@ -282,6 +282,13 @@ class PolymodHandler
// System.load() can load malicious DLLs
Polymod.blacklistImport('lime.system.System');
// `lime.utils.Assets`
// Literally just has a private `resolveClass` function for some reason?
Polymod.blacklistImport('lime.utils.Assets');
Polymod.blacklistImport('openfl.utils.Assets');
Polymod.blacklistImport('openfl.Lib');
Polymod.blacklistImport('openfl.system.ApplicationDomain');
// `openfl.desktop.NativeProcess`
// Can load native processes on the host operating system.
Polymod.blacklistImport('openfl.desktop.NativeProcess');