Loading plugin from full path

[thexa4]

I am currently adding workshop support for Empires Mod and want to make it possible for people to submit and load SourceMod workshop items.

Because workshop items are placed outside the game directory by steam the workshop code mounts them in using the gameinfo.txt search paths.

SourceMod seems to load plugins from a fixed relative directory and doesn't seem to use the steam filesystem:

sourcemod/core/logic/PluginSys.cpp

Line 192 in 07ba8df

g_pSM->BuildPath(Path_SM, fullpath, sizeof(fullpath), "plugins/%s", file);

Is there a way to load a plugin using a full path? Or can workshop loading be accomplished in a different way?

[KyleSanderson]

While not the "official" answer, I've been using https://linux.die.net/man/2/symlink for years with CS:S and it's served me well. Maybe this would help you too?

[thexa4]

Thanks, unfortunately that wouldn't work on windows and would make it very hard to deal with workshop items the player unsubscribes from.

[Timocop]

System links also exist on Windows. Take a look at https://technet.microsoft.com/de-de/us-en/library/cc753194(v=ws.10).aspx

[asherkin]

I do not think the workshop is a good path to managing SourceMod plugins, and we'd definitely prefer if games didn't touch any files inside the SourceMod directory.

Loading plugins from the game search paths would have be very, very well considered before implementation - we definitely do not want a repeat of the VSP loading exploits - and people have already tried packing malicious SourceMod plugin binaries into public maps...

All in all, this is a straight 👎 from me on all counts, from user-friendliness to security.

[thexa4]

Currently workshop items which bundle source plugins need to be signed with a trusted public key before they are loaded, this can be extended to sourcemod plugins as well. I agree that loading using the search paths could result in security issues. As far as I can see, loading a plugin based on a full path would not present these issues.

Why do you think the workshop would be a bad path to managing SourceMod plugins?

[peace-maker]

Loading plugins from arbitrary paths is a serious security issue and it looks like we decided against opening this up. #1437