[Ketho]

Originally Posted by Lombra AcceptTrade doesn't require a hardware event? That is terrible. Or are they being tricked into executing that somehow?

Yes, they are being tricked into executing that by catching any hardware events with a secure frame
I don't know how exactly they do that, but I could only manage catching any left-clicks

Originally Posted by Kanegasi What about something like saving AcceptTrade() into a local object, wiping the main one to nil, then setting TradeFrameTradeButton's onclick script to call the local object. That way, a trade is accepted only if the Trade UI's confirm button is clicked.

Good idea. Or maybe without wiping the global one to nil, to not break any other Trade UI related addons.

local oldAcceptTrade = AcceptTrade
 
function AcceptTrade()
    if RunScript ~= RemoveExtraSpaces then
        oldAcceptTrade()
    end
end
 
TradeFrameTradeButton:SetScript("OnClick", AcceptTrade)

It might be really obvious, but why is RemoveExtraSpaces not a local scope function It's only being used in ChatFrame.lua

@Resike: So there is no way to stop an addon message before it already has done the damage?


Edit: It looks like Blizzard is already checking for any suspicious whisper messages?



It's not possible to say "loadstring" anymore in chat channels, including whisper

But they could still whisper something like

pcall(_G["load".."string"](msg))