Merge branch 'Chatterino:master' into chatterino7

.github/workflows/build.yml

@@ -165,7 +165,7 @@ jobs:
 
       - name: Setup sccache (Windows)
         # sccache v0.7.4
-        uses: hendrikmuhs/[email protected].14
+        uses: hendrikmuhs/[email protected].16
         if: startsWith(matrix.os, 'windows')
         with:
           variant: sccache
@@ -434,7 +434,7 @@ jobs:
         shell: bash
 
       - name: Create release
-        uses: ncipollo/release-action@v1.14.0
+        uses: ncipollo/release-action@v1.15.0
         with:
           replacesArtifacts: true
           allowUpdates: true

.github/workflows/test-windows.yml

@@ -68,7 +68,7 @@ jobs:
 
       - name: Setup sccache
         # sccache v0.7.4
-        uses: hendrikmuhs/[email protected].14
+        uses: hendrikmuhs/[email protected].16
         with:
           variant: sccache
           # only save on the default (master) branch

.prettierrc

@@ -1,6 +1,9 @@
 trailingComma: es5
 endOfLine: auto
 overrides:
+  - files: "*.ts"
+    options:
+      tabWidth: 4
   - files: "*.md"
     options:
       proseWrap: preserve

CHANGELOG.md

@@ -6,6 +6,7 @@
 - Minor: Treat all browsers starting with `firefox` as a Firefox browser. (#5805)
 - Minor: Remove incognito browser support for `opera/launcher` (this should no longer be a thing). (#5805)
 - Minor: Remove incognito browser support for `iexplore`, because internet explorer is EOL. (#5810)
+- Bugfix: Fixed a potential way to escape the Lua Plugin sandbox. (#5846)
 - Bugfix: Fixed a crash relating to Lua HTTP. (#5800)
 - Bugfix: Fixed a crash that could occur on Linux and macOS when clicking "Install" from the update prompt. (#5818)
 - Bugfix: Fixed missing word wrap in update popup. (#5811)

docs/chatterino.d.ts

@@ -1,133 +1,132 @@
 /** @noSelfInFile */
 
 declare module c2 {
-  enum LogLevel {
-    Debug,
-    Info,
-    Warning,
-    Critical,
-  }
-  class CommandContext {
-    words: String[];
-    channel: Channel;
-  }
-
-  enum Platform {
-    Twitch,
-  }
-  enum ChannelType {
-    None,
-    Direct,
-    Twitch,
-    TwitchWhispers,
-    TwitchWatching,
-    TwitchMentions,
-    TwitchLive,
-    TwitchAutomod,
-    Irc,
-    Misc,
-  }
-
-  interface IWeakResource {
-    is_valid(): boolean;
-  }
-
-  interface ISharedResource {}
-
-  class RoomModes {
-    unique_chat: boolean;
-    subscriber_only: boolean;
-    emotes_only: boolean;
-    follower_only: null | number;
-    slow_mode: null | number;
-  }
-  class StreamStatus {
-    live: boolean;
-    viewer_count: number;
-    uptime: number;
-    title: string;
-    game_name: string;
-    game_id: string;
-  }
-
-  class Channel implements IWeakResource {
-    is_valid(): boolean;
-    get_name(): string;
-    get_type(): ChannelType;
-    get_display_name(): string;
-    send_message(message: string, execute_commands: boolean): void;
-    add_system_message(message: string): void;
-
-    is_twitch_channel(): boolean;
-
-    get_room_modes(): RoomModes;
-    get_stream_status(): StreamStatus;
-    get_twitch_id(): string;
-    is_broadcaster(): boolean;
-    is_mod(): boolean;
-    is_vip(): boolean;
-
-    static by_name(name: string, platform: Platform): null | Channel;
-    static by_twitch_id(id: string): null | Channel;
-  }
-
-  enum HTTPMethod {
-    Get,
-    Post,
-    Put,
-    Delete,
-    Patch,
-  }
-
-  class HTTPResponse implements ISharedResource {
-    data(): string;
-    status(): number | null;
-    error(): string;
-  }
-
-  type HTTPCallback = (res: HTTPResponse) => void;
-  class HTTPRequest implements ISharedResource {
-    on_success(callback: HTTPCallback): void;
-    on_error(callback: HTTPCallback): void;
-    finally(callback: () => void): void;
-
-    set_timeout(millis: number): void;
-    set_payload(data: string): void;
-    set_header(name: string, value: string): void;
-
-    execute(): void;
-
-    // might error
-    static create(method: HTTPMethod, url: string): HTTPRequest;
-  }
-
-  function log(level: LogLevel, ...data: any[]): void;
-  function register_command(
-    name: String,
-    handler: (ctx: CommandContext) => void
-  ): boolean;
-
-  class CompletionEvent {
-    query: string;
-    full_text_content: string;
-    cursor_position: number;
-    is_first_word: boolean;
-  }
-
-  class CompletionList {
-    values: String[];
-    hide_others: boolean;
-  }
-
-  enum EventType {
-    CompletionRequested = "CompletionRequested",
-  }
-
-  type CbFuncCompletionsRequested = (ev: CompletionEvent) => CompletionList;
-  type CbFunc<T> = T extends EventType.CompletionRequested
-    ? CbFuncCompletionsRequested
-    : never;
-
-  function register_callback<T>(type: T, func: CbFunc<T>): void;
-  function later(callback: () => void, msec: number): void;
+    enum LogLevel {
+        Debug,
+        Info,
+        Warning,
+        Critical,
+    }
+    class CommandContext {
+        words: string[];
+        channel: Channel;
+    }
+
+    enum ChannelType {
+        None,
+        Direct,
+        Twitch,
+        TwitchWhispers,
+        TwitchWatching,
+        TwitchMentions,
+        TwitchLive,
+        TwitchAutomod,
+        Misc,
+    }
+
+    interface IWeakResource {
+        is_valid(): boolean;
+    }
+
+    interface ISharedResource {}
+
+    class RoomModes {
+        unique_chat: boolean;
+        subscriber_only: boolean;
+        emotes_only: boolean;
+        follower_only: null | number;
+        slow_mode: null | number;
+    }
+    class StreamStatus {
+        live: boolean;
+        viewer_count: number;
+        uptime: number;
+        title: string;
+        game_name: string;
+        game_id: string;
+    }
+
+    class Channel implements IWeakResource {
+        is_valid(): boolean;
+        get_name(): string;
+        get_type(): ChannelType;
+        get_display_name(): string;
+
+        send_message(message: string, execute_commands: boolean): void;
+        send_message(message: string): void;
+
+        add_system_message(message: string): void;
+
+        is_twitch_channel(): boolean;
+
+        get_room_modes(): RoomModes;
+        get_stream_status(): StreamStatus;
+        get_twitch_id(): string;
+        is_broadcaster(): boolean;
+        is_mod(): boolean;
+        is_vip(): boolean;
+
+        static by_name(name: string): null | Channel;
+        static by_twitch_id(id: string): null | Channel;
+    }
+
+    enum HTTPMethod {
+        Get,
+        Post,
+        Put,
+        Delete,
+        Patch,
+    }
+
+    class HTTPResponse implements ISharedResource {
+        data(): string;
+        status(): number | null;
+        error(): string;
+    }
+
+    type HTTPCallback = (res: HTTPResponse) => void;
+    class HTTPRequest implements ISharedResource {
+        on_success(callback: HTTPCallback): void;
+        on_error(callback: HTTPCallback): void;
+        finally(callback: () => void): void;
+
+        set_timeout(millis: number): void;
+        set_payload(data: string): void;
+        set_header(name: string, value: string): void;
+
+        execute(): void;
+
+        // might error
+        static create(method: HTTPMethod, url: string): HTTPRequest;
+    }
+
+    function log(level: LogLevel, ...data: any[]): void;
+    function register_command(
+        name: string,
+        handler: (ctx: CommandContext) => void
+    ): boolean;
+
+    class CompletionEvent {
+        query: string;
+        full_text_content: string;
+        cursor_position: number;
+        is_first_word: boolean;
+    }
+
+    class CompletionList {
+        values: string[];
+        hide_others: boolean;
+    }
+
+    enum EventType {
+        CompletionRequested = "CompletionRequested",
+    }
+
+    type CbFuncCompletionsRequested = (ev: CompletionEvent) => CompletionList;
+    type CbFunc<T> = T extends EventType.CompletionRequested
+        ? CbFuncCompletionsRequested
+        : never;
+
+    function register_callback<T>(type: T, func: CbFunc<T>): void;
+    function later(callback: () => void, msec: number): void;
 }

docs/plugin-meta.lua

@@ -70,6 +70,8 @@ c2.ChannelType = {
 ---@field subscriber_only boolean
 ---@field unique_chat boolean You might know this as r9kbeta or robot9000.
 ---@field emotes_only boolean Whether or not text is allowed in messages. Note that "emotes" here only means Twitch emotes, not Unicode emoji, nor 3rd party text-based emotes
+---@field follower_only number? Time in minutes you need to follow to chat or nil.
+---@field slow_mode number? Time in seconds you need to wait before sending messages or nil.
 
 -- End src/providers/twitch/TwitchChannel.hpp
 

src/controllers/plugins/LuaAPI.cpp

@@ -264,6 +264,11 @@ void g_print(ThisPluginState L, sol::variadic_args args)
     logHelper(L, L.plugin(), stream, args);
 }
 
+void package_loadlib(sol::variadic_args args)
+{
+    throw std::runtime_error("package.loadlib: this function is a stub!");
+}
+
 }  // namespace chatterino::lua::api
 // NOLINTEND(*vararg)
 #endif

src/controllers/plugins/LuaAPI.hpp

@@ -128,6 +128,8 @@ void c2_later(ThisPluginState L, sol::protected_function callback, int time);
 // These ones are global
 sol::variadic_results g_load(ThisPluginState s, sol::object data);
 void g_print(ThisPluginState L, sol::variadic_args args);
+
+void package_loadlib(sol::variadic_args args);
 // NOLINTEND(readability-identifier-naming)
 
 // This is for require() exposed as an element of package.searchers

src/controllers/plugins/PluginController.cpp

@@ -244,6 +244,9 @@ void PluginController::initSol(sol::state_view &lua, Plugin *plugin)
     io.set_function("write", &lua::api::io_write);
     io.set_function("popen", &lua::api::io_popen);
     io.set_function("tmpfile", &lua::api::io_tmpfile);
+
+    sol::table package = g["package"];
+    package.set_function("loadlib", &lua::api::package_loadlib);
 }
 
 void PluginController::load(const QFileInfo &index, const QDir &pluginDir,

src/providers/twitch/TwitchChannel.hpp

@@ -115,24 +115,26 @@ class TwitchChannel final : public Channel, public ChannelChatters
          */
         bool emoteOnly = false;
 
+        /**
+         * @lua@field follower_only number? Time in minutes you need to follow to chat or nil.
+         */
         /**
          * @brief Number of minutes required for users to be followed before typing in chat
          *
          * Special cases:
          * -1 = follower mode off
          *  0 = follower mode on, no time requirement
-         *
-         * @lua@field follower_only number? Time in minutes you need to follow to chat or nil.
-         **/
+         */
         int followerOnly = -1;
 
+        /**
+         * @lua@field slow_mode number? Time in seconds you need to wait before sending messages or nil.
+         */
         /**
          * @brief Number of seconds required to wait before typing emotes
          *
          * 0 = slow mode off
-         *
-         * @lua@field slow_mode number? Time in seconds you need to wait before sending messages or nil.
-         **/
+         */
         int slowMode = 0;
     };
 

tests/src/IrcMessageHandler.cpp

@@ -610,7 +610,10 @@ TEST_P(TestIrcMessageHandlerP, Run)
 
     delete ircMessage;
 
-    ASSERT_TRUE(snapshot->run(got, UPDATE_SNAPSHOTS));
+    ASSERT_TRUE(snapshot->run(got, UPDATE_SNAPSHOTS))
+        << "Snapshot " << snapshot->name() << " failed. Expected JSON to be\n"
+        << QJsonDocument(snapshot->output().toArray()).toJson() << "\nbut got\n"
+        << QJsonDocument(got).toJson() << "\ninstead.";
 }
 
 INSTANTIATE_TEST_SUITE_P(