Security Update for User Widgets
With the addition of the Plugins tab we are now more officially supporting widgets made by the community. To make sure every widget you install stays safe and can't run malicious code that could harm your system, we are introducing a sandbox for user widgets. This change will go live with the next release (time unspecified).
Widget creators: this post is mainly for you. Please review the changes below and update your widgets. Players: some of your widgets may stop working until their authors update them. If a widget breaks, check with its creator for a new version.
These changes only affect user widgets, meaning the ones in your own LuaUI/Widgets folder. Built-in widgets are not affected.
Notable: RmlUi temporarily disabled
RmlUi is unavailable to user widgets for now. We are working on an engine patch that re-enables it inside the sandbox, so this is temporary. Until then, widgets that check for it before using it will still load, just without their RmlUi interface.
Sandboxed tables
widgetHandler, WG.options, debug and Spring are now sandboxed copies and may have reduced function.
- Functions that manage or read other widgets are removed for now. Share data through WG instead.
- Handler calls no longer take your widget as an argument. Most handler fields you could read are now method calls, e.g. mouseOwner becomes IsMouseOwner().
- debug keeps only traceback and getinfo.
Environments
- Your widget's own table is the only environment it can see.
- getfenv, setfenv and the code loading functions all use that table, so anything your widget loads runs there, not in LuaUI globals.
- Precompiled bytecode is refused. Load from source.
Commands and files
- Commands that control widgets, execute code or change keybinds are refused. This includes custom command buttons.
- Write access: only LuaUI/Config/ and LuaUI/Widgets/
- Read access: only LuaUI/, plus the game's and maps' own files
Also no longer available
- No network access
- No starting or restarting the engine
When something breaks
If the sandbox blocks something, the reason is logged in infolog.txt and your widget keeps running. Check there first before reporting issues.
Resources for Widget Creators for updating:
- 🔗 Writing user widgets - General guide for writing widgets in the new environment
- 🔗 Migrating a BAR user widget to the sandboxed widget environment - Instructions for your favourite AI agent
20 points · 10 comments
Mentions
Eh, I think it's a continuum , small projects don't need standards, but large projects eventually need standards. For example, Beyond All Reason recently added code format linting errors and static code analysis just to help alleviate the load on the small group of people doing code reviews. The project had been getting along without it, but with well-meaning-but-vibe-coded PRs being proposed at an incredible rate... There was value to be found in automated (non-llm-based) code review. github.com/beyond-all-reason/Beyond-All-Reason/tr…
Security Update for User Widgets With the addition of the Plugins tab we are now more officially supporting widgets made by the community. To make sure every widget you install stays safe and can't run malicious code that could harm your system, we are introducing a sandbox for user widgets. This change will go live with the next release (time unspecified). Widget creators: this post is mainly for you. Please review the changes below and update your widgets. Players: some of your widgets may stop working until their authors update them. If a widget breaks, check with its creator for a new version. These changes only affect user widgets, meaning the ones in your own LuaUI/Widgets folder. Built-in widgets are not affected. Notable: RmlUi temporarily disabled RmlUi is unavailable to user widgets for now. We are working on an engine patch that re-enables it inside the sandbox, so this is temporary. Until then, widgets that check for it before using it will still load, just without their RmlUi interface. Sandboxed tables widgetHandler, WG.options, debug and Spring are now sandboxed copies and may have reduced function. - Functions that manage or read other widgets are removed for now. Share data through WG instead. - Handler calls no longer take your widget as an argument. Most handler fields you could read are now method calls, e.g. mouseOwner becomes IsMouseOwner(). - debug keeps only traceback and getinfo. Environments - Your widget's own table is the only environment it can see. - getfenv, setfenv and the code loading functions all use that table, so anything your widget loads runs there, not in LuaUI globals. - Precompiled bytecode is refused. Load from source. Commands and files - Commands that control widgets, execute code or change keybinds are refused. This includes custom command buttons. - Write access: only LuaUI/Config/ and LuaUI/Widgets/ - Read access: only LuaUI/, plus the game's and maps' own files Also no longer available - No network access - No starting or restarting the engine When something breaks If the sandbox blocks something, the reason is logged in infolog.txt and your widget keeps running. Check there first before reporting issues. Resources for Widget Creators for updating: - 🔗 Writing user widgets - General guide for writing widgets in the new environment - 🔗 Migrating a BAR user widget to the sandboxed widget environment - Instructions for your favourite AI agent
Spiritual successor already exists: beyond-all-reason/Beyond-All-Reason