From 7286183ec95c25067f4ca9d1a7e0ae5c650954ce Mon Sep 17 00:00:00 2001 From: requazar Date: Sun, 17 May 2026 14:06:42 -0700 Subject: [PATCH] blacklist openfl.Assets and classtypes --- source/funkin/modding/PolymodHandler.hx | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/source/funkin/modding/PolymodHandler.hx b/source/funkin/modding/PolymodHandler.hx index 974132dcfa2..72b2c1e9d66 100644 --- a/source/funkin/modding/PolymodHandler.hx +++ b/source/funkin/modding/PolymodHandler.hx @@ -369,6 +369,7 @@ class PolymodHandler // `lime.utils.Assets` literally just has a private `resolveClass` function for some reason? so we replace it with our own. Polymod.addImportAlias('lime.utils.Assets', funkin.Assets); Polymod.addImportAlias('openfl.utils.Assets', funkin.Assets); + Polymod.addImportAlias('openfl.Assets', funkin.Assets); // `funkin.util.FileUtil` has unrestricted access to the file system. Polymod.addImportAlias('funkin.util.FileUtil', funkin.util.FileUtilSandboxed); @@ -465,6 +466,12 @@ class PolymodHandler // Disallow direct manipulation of save data. Polymod.blacklistStaticFields(flixel.FlxG, ['save']); + /** + * Using the `AssetManifest` class can get you a `Future` that holds an `AssetLibrary` + * that you can then use to resolve to blacklisted classes using the `classTypes` field. + **/ + Polymod.blacklistInstanceFields('lime.utils.AssetLibrary', ['classTypes']); + // `haxe.Unserializer` // Just to be double-sure, lets blacklist some fields of the Unserializer to make it harder to use if you DO get one. Polymod.blacklistStaticFields(haxe.Unserializer, ['run']);