[VULNERABILITY] Blacklist readObject() functions

[charlesisfeline]

Description

blacklists the readObject() function in ByteArrayData, FileStream, and Socket since they all return Unserializer.run if encoded in HXSF format.
btw do note that for the exploit to work, they have to be serialized properly

if i see Unserializer one more time im gonna shit myself

(yes ik FileStream and Socket aren't compiled in even without DCE but still, this prevents scripts from using it even when #7115 gets merged)

[TechnikTil]

[FuroYT]

as the leader of the EliteMasters we approve this pull request

[TechnikTil]

import funkin.modding.module.Module;
import openfl.utils.ByteArrayData;
import haxe.io.Bytes;

class ByteArrayExploit extends Module
{
  public function new()
  {
    super('byteArrayExploit');
  }

  public function onCreate(event:ScriptEvent)
  {
    var typeSerialized:String = "Ay4:Type"; // representation of the type class inside of HXSF.

    // turn it into bytes that the reader can read
    var byteArrayWriter:ByteArrayData = new ByteArrayData();
    byteArrayWriter.writeUTF(typeSerialized);

    // create bytearray with those bytes we wrote, and make sure it uses hxsf so it reads properly.
    var byteArrayReader:ByteArrayData = ByteArrayData.fromBytes(byteArrayWriter);
    byteArrayReader.objectEncoding = 10;

    // resolve class evilly
    var type = byteArrayReader.readObject();
    var polymore = type.resolveClass('polymod.Polymod');
    throw polymore.listModFiles(); // if this throws the right thing, then it works!
    super.onCreate(event);
  }
}

heres a module to test this exploit:

[charlesisfeline]

idk havent done rebasing before ;-;

[EliteMasterEric]

For the record, blacklisting classes is not a CHORE, that label is reserved purely for pull requests with no functional changes (or at least no intended functional changes).

[EliteMasterEric]

also YOU STOLE MY EMOJI

AFTER ALL I'VE DONE FOR YOU PEOPLE

[FuroYT]

:eric_whoopsies:

[anysad]

also YOU STOLE MY EMOJI

AFTER ALL I'VE DONE FOR YOU PEOPLE

[TechnikTil]

also YOU STOLE MY EMOJI

AFTER ALL I'VE DONE FOR YOU PEOPLE

whoopsie!

[requazar]

also YOU STOLE MY EMOJI

AFTER ALL I'VE DONE FOR YOU PEOPLE