10 Commits

Author SHA1 Message Date
James King
6e71079a04 Fix ILHotload falling apart when doing incremental compiles (#5376)
* Simplify by removing BeforeILHotloadProcessingTrees
* Strip ILHotload attribs when comparing syntax trees
* MethodBodyChanged attribute is versioned to support incremental compiles
* Possible fix for Facepunch/sbox-public#11275
2026-07-21 15:18:18 +02:00
Matt Stevens
3f11417817 Whitelist: explicit Unsafe/Span/Memory (#5077)
* Whitelist System.Memory and System.ReadOnlyMemory (without pinning)
* Be very explicit with System.Span and System.ReadOnlySpan whitelists, do not allow pinnables
* Be completely explicit with Unsafe IL whitelist, allow Unsafe.SizeOf<T>
* BlacklistCodeWalker can have an allow list
* Compiler blacklist explicitly bans CreateSpan, allows Unsafe.SizeOf<T>
* Whitelist System.IO.InvalidDataException
* Better InlineArray whitelisting for compiler generated code
* WhitelistGen: Creates explicit signatures from wildcard rules
* Claude skill for whitelisting, uses the WhitelistGen tool to be very explicit and makes a good effort to security review
2026-06-17 18:28:47 +01:00
Sol Williams
87014c94c7 Editor: cache built-in project assemblies (#4223)
Cache and reuse built-in project assemblies instead of recompiling on every editor startup, saving +10s on my machine. (disabled for non-retail builds)
2026-06-11 15:34:16 +01:00
Lorenz Junglas
0a7c021079 ! Fix CompilerService attributes based RCE exploit (#4307)
* ! Add tests replicating H1-3601675 attribute RCE

* ! Add tests for potentially dangerous SkipLocalsInit, AsyncMethodBuilder

* ! Blacklist SkipLocalsInit, UnsafeAccessor, AsyncMethodBuilder
2026-03-18 10:00:01 +01:00
Lorenz Junglas
bc36ace71e Fix array pool use after free exploit (#4161)
* ! Reimplement SharedArrayPool because it is internal in .net runtime

* ! Expose PublicArrayPool that maps to our copy of SharedArrayPool

* ! CodeGenerator that remaps System.Buffers.ArrayPool.Shared calls to Sandbox.PublicArrayPool

* ! Don't run ArrayPoolUpgrader in full engine builds

* ! Add tests that verifies ArrayPool.Shared replacements

* ! Remove ArrayPool.Shared from whitelist

* ! Build AST from nodes instead of parsing text

* ! Use Reflection to grab Gen2GcCallback instead of event polling
2026-03-03 19:34:26 +00:00
Sol Williams
45c9cd1aa6 Razor incremental processing + tree reuse (#4139) 2026-02-25 13:11:49 +00:00
Sol Williams
6668270f7b Incremental compiles: smarter processing, syntax tree reuse (#4011)
Avoids unnecessary reparsing and allocations by reusing identical trees, and running generators only on what's been modified, significantly reducing incremental compile times for small changes in large codebases.
2026-02-19 14:29:56 +00:00
Lorenz Junglas
236b95e0ed Disposable diagnostic (#3693)
* Enable CA2000 in editorconfig

* Remove unused CaptureStdOut class

* Add missing dispose calls in Sandbox.Tools

* Add missing dispose calls in tests

* Add missing dispose calls in launchers

* Add missing dispose calls in Topten.RichtTextKit

* Add missing dispose calls in Engine

* Add missing dispose calls in SboxBuild

* Add nullchecks to a few dispose calls

* Fix more missing disposal calls and leaks

* Disable CA2000 for Textures

* Fix disposing too early in ImageFileTextureGenerator

* Fix disposing codec, ownership is transferred to animation

* Add missing using in ByteStream benchmark
2026-01-12 21:59:15 +01:00
Matt Stevens
8c25780848 Fix Compiler.config not being initialized by default
* Extended whitelist tests to use the other method of creating a compiler without explicit compiler settings
* Initialize Compiler._config as it's a struct so everything was zeroed before
2025-12-17 11:07:19 +00:00
s&box team
71f266059a Open source release
This commit imports the C# engine code and game files, excluding C++ source code.

[Source-Commit: ceb3d758046e50faa6258bc3b658a30c97743268]
2025-11-24 09:05:18 +00:00