[MODDING] Sandboxed FlxSave

source/funkin/modding/PolymodHandler.hx

@@ -256,6 +256,9 @@ class PolymodHandler
     // NOTE: Scripted classes are automatically aliased to their parent class.
     Polymod.addImportAlias('flixel.math.FlxPoint', flixel.math.FlxPoint.FlxBasePoint);
 
+    // flixel.util.FlxSave has a `resolveFlixelClasses` function
+    Polymod.addImportAlias('flixel.util.FlxSave', funkin.save.FlxSaveSandboxed);
+
     Polymod.addImportAlias('funkin.data.event.SongEventSchema', funkin.data.event.SongEventSchema.SongEventSchemaRaw);
 
     // `lime.utils.Assets` literally just has a private `resolveClass` function for some reason? so we replace it with our own.
@@ -315,10 +318,6 @@ class PolymodHandler
     // Unserializer.DEFAULT_RESOLVER.resolveClass() can access blacklisted packages
     Polymod.blacklistImport('haxe.Unserializer');
 
-    // `flixel.util.FlxSave`
-    // FlxSave.resolveFlixelClasses() can access blacklisted packages
-    Polymod.blacklistImport('flixel.util.FlxSave');
-
     // Disable access to AdMob Util
     Polymod.blacklistImport('funkin.mobile.util.AdMobUtil');
 

source/funkin/save/FlxSaveSandboxed.hx

@@ -0,0 +1,37 @@
+package funkin.save;
+
+import flixel.util.FlxSave;
+import haxe.Exception;
+
+/**
+ * Wrapper for `FlxSave`
+ * Prevents the use of `resolveFlixelClasses` function
+ * Also locks down saves to only save inside the `FunkinCrew` folder
+ */
+@:nullSafety
+class FlxSaveSandboxed extends FlxSave
+{
+  public function new()
+  {
+    super();
+  }
+
+	override public function bind(name:String, ?path:String, ?backupParser:(String, Exception)->Null<Any>):Bool
+  {
+    if (name == Constants.SAVE_NAME + Constants.BASE_SAVE_SLOT && path == null) throw 'Unable to bind to $name. Use funkin.save.Save instead.';
+    return super.bind(name, Constants.SAVE_PATH + (path != null ? '/$path' : ''), backupParser);
+  }
+
+  override public function mergeDataFrom(name:String, ?path:String, overwrite = false, eraseSave = true, minFileSize = 0):Bool
+  {
+    if (name == Constants.SAVE_NAME + Constants.BASE_SAVE_SLOT && path == null) throw 'Unable to merge from a Funkin save.';
+    return super.mergeDataFrom(name, Constants.SAVE_PATH + (path != null ? '/$path' : ''), overwrite, false, minFileSize);
+  }  
+
+  @:unreflective
+  override public function erase():Bool
+  {
+    if (this.name == Constants.SAVE_NAME + Constants.BASE_SAVE_SLOT && this.path == Constants.SAVE_PATH) throw 'Unable to delete ${this.name}.';
+    return super.erase();
+  }  
+}