Seramate PvP Inspect

v2026.08.11 (2026-08-11)

Full Changelog Previous Releases

• Read WoW-supplied strings through a secret scrub
  The unit right-click menu crashed with "attempt to compare field 'name'
  (a secret string value, while execution tainted by 'Seramate')": our own
  ModifyMenu callback taints the menu build, and 12.x hands tainted code
  contextData.name/.server as secrets, which may not be compared or even
  boolean-tested. The earlier hardening only scrubbed contextData.unit.
  Util.plainString replaces scrubSecret as the one way to read a string the
  client handed us — secret, non-string and "" all collapse to nil, so a
  caller can boolean-test the result. Keys.lookup and Keys.splitFullName
  scrub at the funnel every surface reaches, so a future surface that
  forgets can't reproduce the crash; the surfaces still scrub what they use
  locally for guard tokens. cleanName scrubs too, since a secret rejects
  :gsub as indexed access.