Howdy, i know this is going to be an odd issue but im 99% certain I've narrowed it down to bagnon despite the lua error that occurs not specifically stating so

I play with an xbox controller using consoleport due to an irl injury. Inside consoleport there is a keybind that assigns button combinations to unit frames that allows me to press the keybind and the button combo to target a part or raid member if i need to buff them or heal them.

Every time I open bagnon (elvui bags as well, but other bag addons seem to be unaffected, adibags, etc), it breaks this function when i press my target unit frames keybind and bricks my UI and requires a /reload. i cant cast anything on my bars when this happens.

I get two lua errors I believe is associated with this

623x FrameXML\RestrictedExecution.lua:431: Call failed: FrameXML\RestrictedExecution.lua:473: Cannot call restricted closure from insecure code

261x FrameXML\RestrictedExecution.lua:431: Call failed: FrameXML\RestrictedExecution.lua:431: Call failed: FrameXML\RestrictedExecution.lua:431: Call failed: FrameXML\RestrictedExecution.lua:431: Call failed: FrameXML\RestrictedInfrastructure.lua:365: Cannot create restricted tables from insecure code

I've spoken to the addon dev of consoleport, believes it is an issue within the Poncho lib, and he wanted me to share this screenshot of a snippet of code with you

https://cdn.discordapp.com/attachments/215621772542869506/749670469850103808/unknown.png

he believes it has something to do with setting custom metatables on children of UIParent

I can say this error hasnt always occured. It only started happening after an update sometime midway through bfa, maybe eternal palace patch? I cant remember exactly but back in Legion and early bfa it never occured.

I have tried turning off every addon so the only addons enabled are consoleport and bagnon, the base addon, none of the plugins, this is why I believe the conflict is with bagnon.

I know this is a lot to ask of you for such a niche use case but i really like bagnon, have used it for ages, and I dislike adibags and all the other bag addons. If you could find time to look into this

TaintIssueUIParent.zip

I'm attaching a small addon that triggers the error from restricted environments when Bagnon has created its main frame.

My guess is that this stems from the Poncho library setting __index on frames when they are created using your class system, which flairs the taint issue when :GetChildren() is called on the frame from the restricted environment.

There is unfortunately no way around this, since the restricted frame wrapper for :GetChildren() forces the method to come from the frame fed to the function.

I understand this issue may not be a big deal, because it's a niche case to do secure recursive lookups on UIParent, but I think it's possible to rewrite your code in a way where the frame does not become taint-bearing when calling normal methods.

Bumping. Having same issue so need to stop using bagnon and i liked it alot 😞

Came up with solution: on the secure code, replace the call to a random unkown function with the actual strictly intended function.

local GetChildren = getmetatable(SOME_FRAME_OWNED_BY_THE_ADDON).__index.GetChildren 

function HANDLE:GetChildren()
   return FrameHandleMapper(not InCombatLockdown(), GetChildren(GetHandleFrame(self)))
end

If you guys want to try it yourselves, replace those 3 lines with:

local GetChildren = getmetatable(UIParent).__index.GetChildren 

function HANDLE:GetChildren()
   return FrameHandleMapper(not InCombatLockdown(), GetChildren(GetHandleFrame(self)))
end

Unfortunately there is nothing I can do about it from my end, as the entire addon is built on metaprogramming.

I know this solves the problem, but this is something only Blizzard can change, because they are providing the restricted environment. I'm sure you're aware of LibActionButton, which also sets metatables directly on protected buttons, but doesn't experience the same issue with restricted environments. I think the reason for this is that the deepest __index fallback (where GetChildren is located) is an untouched CheckButton, and not a custom table. Will report to Blizzard and keep my fingers crossed.