From b0fd471f8a54a4b3ead8dedb962b5f8a2ff04c7b Mon Sep 17 00:00:00 2001
From: charlesisfeline <62410083+charlesisfeline@users.noreply.github.com>
Date: Wed, 11 Mar 2026 20:10:41 -0400
Subject: [PATCH] Blacklist 'readObject` from scripts

---
 source/funkin/modding/PolymodHandler.hx | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/source/funkin/modding/PolymodHandler.hx b/source/funkin/modding/PolymodHandler.hx
index 52625fea6..f1db50394 100644
--- a/source/funkin/modding/PolymodHandler.hx
+++ b/source/funkin/modding/PolymodHandler.hx
@@ -425,6 +425,12 @@ class PolymodHandler
       'clearData', // No score manipulation please
       'setLevelScore', 'setSongScore', 'applySongRank']);
 
+    // `openfl.filesystem.FileStream`, `openfl.net.Socket`, `openfl.utils.ByteArray.ByteArrayData`
+    // Returns `Unseralizer.run` if encoded in HXSF format, though it does have to be seralized correctly for the exploit to work.
+    Polymod.blacklistInstanceFields(openfl.filesystem.FileStream, ['readObject']);
+    Polymod.blacklistInstanceFields(openfl.net.Socket, ['readObject']);
+    Polymod.blacklistInstanceFields(openfl.utils.ByteArray.ByteArrayData, ['readObject']);
+
     // `funkin.api.*`
     // Contains functions which may allow for cheating and such.
     for (cls in ClassMacro.listClassesInPackage('funkin.api'))