It seems that in the recent 3.0.2 (8885) beta build any addon that calls
UIDropDownMenu_Initialize(frame, initfunc, ...)
causes action blocked errors due to taint.
Steps to reproduce:
1. Load an addon that uses UIDropDownMenu_Initialize and take whatever action is required for the function to be called
(show an options screen etc)
2. Right-click the target frame and choose "Set Focus"
Similar issues with "Clear Focus".
Both setfocus and clearfocus work without issue if you use keybinds and not the dropdown menu.
Typical taint.log contains:
Global variable UIDROPDOWNMENU_INIT_MENU tainted by _ _ _ _ _
Execution tainted by _ _ _ _ _ while reading UIDROPDOWNMENU_INIT_MENU -
An action was blocked because of taint from _ _ _ _ _ - FocusUnit()
Several addons are giving me those messages.
Those that initialize the dropdown in OnLoad handlers are blamed first.
If you go on disabling, other addons take their place after they call UIDropDownMenu_Initialize
(in OnShow handlers for example)
Haven't found a workaround sofar or a mention on UI & Macros forum so
I don't know if this is expected behavior we're supposed to circumvent somehow.
Edit: Addons in question use local variables btw (self not this) and the action blocked errors
happen regardless of combat status (both when trying to setfocus and showing dropdowns)
ie you'll get them even if you haven't entered combat at all.
Confirming this 100%. I've spend hours trying to troubleshoot and find out what was causing the taint, since I do not call any Blizzard protected function in my dropdowns. Turns out that UIDropDownMenu_Initialize is causing it for certain init functions (not ALL menus taint, but most do, especially if you try to do something more complicated than adding a couple of menu items and I haven't been able to track the 'conditions' that will trigger the taint). If you disable the Dropdown initialization for any menu, everything works fine.
The reason the taint is caused when selecting 'Set Focus' from the playerframe dropdown is the fact that the specific menu item is eventually calling a protected function (specifically FocusUnit), or maybe that it is tied to a SecureUnitButton (not really sure), fact remains that unless there is something we are missing, currently any addon that uses Blizzard's UIDropDownTemplate has a chance to taint that menu. If you invoke the focus frame from the slash handler (/focus) everything works fine.
"I don't know if this is expected behavior we're supposed to circumvent somehow."
Me neither. Perhaps use a secure template somehow or securely hook a few functions ? I'm pretty lost myself. Oh and it doesn't matter much if you use self or this, tested both, both result in the taint.
All righty, I think I've nailed it down to a rather old "bug" (?), reported in the UI and Macros forum.
DEFAULT_CHAT_FRAME:AddMessage("UIDROPDOWNMENU_MAXBUTTONS = " .. UIDROPDOWNMENU_MAXBUTTONS);
-- Create one more menu button than the current maximum.
local num = UIDROPDOWNMENU_MAXBUTTONS + 1;
for i = 1, num do
info = UIDropDownMenu_CreateInfo();
info.text = "Menu item" .. i;
CreateFrame("Frame", "MyTest2", UIParent);
CreateFrame("Frame", "MyTest2_DropDown", MyTest2, "UIDropDownMenuTemplate");
UIDropDownMenu_Initialize(MyTest2_DropDown, MyTest2_DropDown_InitButtons, "MENU");
Disable or delete all addons and create a new one, using the above code. 'Set Focus' will produce a taint. Then change the num variable to UIDROPDOWNMENU_MAXBUTTONS - 1, reloadUI, 'Set Focus', no taint (this was tested in the 8885 build). Apparently, if you create a UIDropDownMenu containing more menu items than the number of menu item buttons that the game has already created, it can cause this sort of behavior.
It is, at least for the vast majority of addons that were simply initializing a menu and only reading some globals. There are still some issues however with addons "inserting" menu items, for instance Chatter's AltNames module is producing a taint because of this (or used to when I tested it on the PTR). Most Unitframe addons also seem to be still affected by this, but I haven't really digged on the code to know more.