wow-api-lua-environment

WoW addon action blocked errors occur because the taint system and combat lockdown restrict insecure code from executing protected actions. InCombatLockdown prevents frame modifications and spell casts during combat to maintain UI security integrity.

Taint propagation in the WoW Lua sandbox spreads insecurity from tainted variables to secure execution contexts. When insecure code modifies global state, that taint flows through calls, blocking protected Blizzard APIs from executing if the execution path is compromised.

Safely hook Blizzard functions in WoW addon development by using hooksecurefunc to attach post-execution callbacks. This secure hooking method allows monitoring function calls without propagating taint to the original secure execution path.

Yes, issecurevariable checks if a variable in the WoW Lua environment is free from taint. It returns whether the variable is secure and its current taint source, allowing addon developers to verify execution context safety before calling restricted functions.

The best way to run delayed code in a WoW addon without triggering taint is using C_Timer. This timer API provides secure scheduling within the Lua sandbox, executing callbacks after specified delays while maintaining the secure execution context.

The FrameScript sandbox in World of Warcraft blocks standard Lua functions like os.execute and loadfile to prevent malicious code execution. Restricted actions are instead routed through C_RestrictedActions to safely manage protected UI and gameplay modifications.