Patch LoadData Vulnerability

[xBaconEgg]

Block all tables inside the blacklisted table,not just the blacklisted table

PoF:
TestCode:

Before:

After:

[xBaconEgg]

This is my first pull request so something might be wrong

[ccuser44]

Is this a vulnerability though?

[xBaconEgg]

MakeScript is in DS_BlackList but MakeScript Args and AdminLevel(Only if it was settings.Permissions "s:200,300") is Accessible

[P3tray]

@xBaconEgg I don't understand this at all. Could you please explain thoroughly what the vulnerability was, what the user could do, and how this fixes it?

Please give a paragraph explaining how someone would abuse this vulnerability, i.e. what they need to do in game.

[xBaconEgg]

@P3tray
Vulnerabilit:
Unauthorized access to nested tables in DS_Blacklist
Severity:
Low
Impact:
Bypass of blacklist restrictions, unauthorized command access
Root Cause:
The old code only checks for exact matches:
-- Old Code
if ds_blacklist[displayName] then
return
end
This fails to block nested table references.
Fix:
Pattern-based check for nested table references(string.match(displayName,^{i}))