[Bug]: attempt to index local 'msg' (a secret string)

[rml9ty]

Description

attempt to index local 'msg' (a secret string value tainted by 'DragonToast')

Steps to Reproduce

not sure unfortunately

Expected Behavior

no error

Actual Behavior

error (sorry, these fields are mandatory)

WoW Version

Retail

DragonToast Version

3.4.0

Additional Context

2x DragonToast/Listeners/LootListener_Shared.lua:250: attempt to index local 'msg' (a secret string value tainted by 'DragonToast')
[DragonToast/Listeners/LootListener_Shared.lua]:250: in function <DragonToast/Listeners/LootListener_Shared.lua:249>
[DragonToast/Listeners/LootListener_Shared.lua]:279: in function <DragonToast/Listeners/LootListener_Shared.lua:277>
[DragonToast/Listeners/LootListener_Shared.lua]:345: in function <DragonToast/Listeners/LootListener_Shared.lua:343>
[C]: ?
[AddonMrgl/libs/CallbackHandler-1.0/CallbackHandler-1.0.lua]:19: in function <...rgl/libs/CallbackHandler-1.0/CallbackHandler-1.0.lua:15>
[AddonMrgl/libs/CallbackHandler-1.0/CallbackHandler-1.0.lua]:54: in function 'Fire'
[AngrierWorldQuests/Libs/AceEvent-3.0/AceEvent-3.0.lua]:120: in function <...ngrierWorldQuests/Libs/AceEvent-3.0/AceEvent-3.0.lua:119>


Locals:
msg = <no value>
patternPair = <table> {
 single = "You receive loot: (.+)"
 multi = "You receive loot: (.+)x(%d+)"
}
(*temporary) = nil
(*temporary) = <no value>
(*temporary) = nil
(*temporary) = nil
(*temporary) = nil
(*temporary) = "attempt to index local 'msg' (a secret string value tainted by 'DragonToast')"

[Xerrion]

Hello @rml9ty,

Does this happen as soon as the addon is loaded or when you try and loot something specific?

[Xerrion]

Tracking a matching report in #177 (cross-posted from DragonLoot#150). Keeping both open; fix will land in a single PR that closes both.

[Xerrion]

Triage - root cause

The crash is at DragonToast/Listeners/LootListener_Shared.lua:250:

local function TrySelfPair(msg, patternPair)
    local itemLink, quantity = msg:match(patternPair.multi)  -- line 250

On retail, certain CHAT_MSG_LOOT payloads arrive as "secret" (censored) strings. Any index operation on such a value - including msg:match(...) - raises attempt to index local 'msg' (a secret string value tainted by 'DragonToast'). The locals dump shows msg = <no value> because the debug API refuses to reveal the protected payload.

The callback in OnChatMsgLoot (line 343) and OnChatMsgMoney (line 356) forwards msg straight into the parsers without any guard. Three defenses are planned:

1. if type(msg) ~= "string" then return end (cheap, always safe)
2. Capture lineID from the event payload and skip when C_ChatInfo.IsChatLineCensored(lineID) is true (retail-only; nil-guarded so it no-ops on TBC/Mists)
3. Wrap the parse call in pcall as belt-and-braces against future sentinel variants

Narrowed platform label to P-Retail - the secret-string sentinel is a retail-only mechanism. Other flavors remain unaffected but will still benefit from defenses 1 and 3 since the shared file is used by all wrappers.

Next step: confirm reproduction vector. Likely triggers include healthstone loot, some instanced drops, and certain tradeable-item lines. If anyone can reproduce deterministically, please share the chat line and zone/context.