Security Brainstorming

[Rick]

I've talked to Stefan about eventually implementing some sort of script security within the NPC server itself to make scripts less exploitable.

I'm posting this thread to see if I can get some people's ideas for this, as well as to get people interested in it.

Some of these ideas will probably be based on other languages which feature security.


Some ideas off the top of my head:

All variables within an NPC are protected. They can be read by other NPCs, but not written to. Variables can be exposed as public by using some method such as "public variable someVar;". This includes system variables (such as rupees, bombs, etc).

I'm not sure how objects should be handled though, for making them public. If it's made so that if you make an object variable is public, all subproperties are public, then you should be able to explicitly mark subproperties as private. Eg: "private variable someObject.property".

You should not be able to do something like this:

putNPC2(x, y, "public variable someVar; join(\"someclass\");");

As it would be a security breach.

This should include clientr variables as well. Obviously not client variables though (for backwards compatability).

Attributes and ani parameters obviously won't be protected (for backwards compatability reasons).

Functions may only be called by another NPC if they are public, which is how it is now.

System object functions which *modify the object itself* (such as player.setLevel2) may only be called from within that object. Perhaps there can be a way to make these functions public as well. This way we can wrap these functions and do any security checks we need to without worrying about scripts bypassing our custom function and calling it directly.

Functions calls should pass an implicit variable called "sender" or "caller". This can either be an automatic thing (like this/params) or could be an argument. For example:

public function someFunc()
{
  if (sender.name != "someTrustedNPC")
  {
    return;
  }
  
  // do whatever...
}

This way we can validate NPCs that are allowed to call our functions -- or impose stricter limits on some NPCs that don't match our criteria.



Feel free to share your ideas/comments/criticism.