Taint problem with SpellBookFrame
 

Hi, I'm trying to write a small addon to enable the mouse wheel on the pet spellbook. The code works fine to navigate the pages, but I have a problem with taint. As soon as I use the mouse wheel on the pet spellbook, any action on the spell buttons in the pet or the normal spellbook is blocked, apart from dragging them to the action bar.

Here is the taint log I get when I right-click on a button to toggle autocast (no other addon loaded):

6/14 14:29:37.701 Global variable ON_BAR_HIGHLIGHT_MARKS tainted by MyAddon - Interface\FrameXML\ActionButton.lua:55 ClearOnBarHighlightMarks()
6/14 14:29:37.701 Interface\FrameXML\SpellBookFrame.lua:489 SpellButton_OnEnter()
6/14 14:29:37.701 SpellButton1:OnEnter()
6/14 14:29:37.701 Execution tainted by MyAddon while reading ON_BAR_HIGHLIGHT_MARKS - Interface\FrameXML\ActionButton.lua:59 GetOnBarHighlightMark()
6/14 14:29:37.701 Interface\FrameXML\ActionButton.lua:462 ActionButton_UpdateSpellHighlightMark()
6/14 14:29:37.701 Interface\FrameXML\ActionButton.lua:371 ActionButton_Update()
6/14 14:29:37.701 Interface\FrameXML\ActionButton.lua:334 ActionButton_UpdateAction()
6/14 14:29:37.701 Interface\FrameXML\ActionBarController.lua:151 ActionBarController_ResetToDefault()
6/14 14:29:37.701 Interface\FrameXML\ActionBarController.lua:140 ActionBarController_UpdateAll()
6/14 14:29:37.701 Interface\FrameXML\SpellBookFrame.lua:507 SpellButton_OnEnter()
6/14 14:29:37.701 SpellButton1:OnEnter()
6/14 14:29:37.701 Interface\FrameXML\SpellBookFrame.lua:1020 SpellBook_GetSpellBookSlot()
6/14 14:29:37.701 An action was blocked because of taint from MyAddon - ToggleSpellAutocast()
6/14 14:29:37.701 Interface\FrameXML\SpellBookFrame.lua:552 SpellButton_OnClick()
6/14 14:29:37.701 SpellButton1:OnClick()

Try a secure hook instead, which is always the best course of action when tampering with a Blizzard frame. And not seeing your entire code, do you have an EnableMouse() call somewhere? Do you need one?

Doesn't need one, SpellBookFrame is already mouse-enabled.

That being said, I can't even get this to work.


https://www.townlong-yak.com/framexm...kFrame.lua#960

I don't think I'm using it wrong, either. A non-secure hook works fine in that same scenario, but of course SpellBookPrevPageButton_OnClick() and SpellBookNextPageButton_OnClick() taint it if called from non-secure addon code.

Maybe they just don't want us being able to securely hook that.

hooksecurefunc replaces the function so OnMouswheel is now calling the old function.

You could try:
Although that will call your function for the next/prev. page clicks as well as SpellBookFrame_UpdatePages().

Edit: That won't work because the function doesn't get called in the pet spellbook.

Last bullet point
Which brings us back to the OP.

That's the entire code right here. It's basically the same function as SpellBookFrame_OnMouseWheel, but applied to the pet spellbook.

Yeah that's the problem. I've also tried to hook both the script handler and the function, without success.
I don't really understand why it's tainting, seeing that I'm - correct me if I'm wrong - hooking securely. Am I missing something?

You use SpellBookPrevPageButton_OnClick, SpellBookNextPageButton_OnClick, which taint a lot of stuff because they're called from insecure environment.

Try commenting out both calls, and see if the taint persists :p You'll be surprised how easy it's to taint stuff >_>

For instance, here's my taint w/ your code :p

Yeah I reckoned these were responsible for the taint. I just thought that, being called like that, they shouldn't cause that much of a problem. Seems that I was wrong. :o

Oh well. I guess I'll abandon this idea and hope someone at Blizzard takes 2 minutes to change the function to work with the pet spellbook…

Thanks for your answers!

The reason it causes taint is that the spellbook contains secure actionbuttons. You can mouse-click spells in the spellbook directly in combat. It's basically just like an actionbar.

How secure frames work, is that its parent and any frames above it in the parent/child hierarchy also becomes secure, meaning the whole spellbook is in fact a secure frame. Changing pages by clicking the prev/next buttons initiates actions that eventually hide and show the secure spellbuttons, and that is something normal Lua can not do while engaged in combat.

Think of it this way; if it contains clickable actionbuttons or clickable unitframes, normal Lua can't show, hide, move, resize or enable/disable mouse, change hit rectangles or do anything that would affect how the user interacts with it while engaged in combat. This is to avoid addons automating or exploiting the gameplay.

Not that physically using the mouse wheel to flip through the spellbook could really be exploited in any shape or form, but that's just how the system works! Go Blizz! ;)