disable static_read in vm.

enu.nimble

@@ -23,12 +23,8 @@ bin_dir = "app/_dlls"
 src_dir = "src"
 bin = @["enu" & lib_ext]
 
-if (NimMajor, NimMinor) >= (1, 7):
-  requires "https://github.com/dsrw/Nim#c07ccfebf"
-else:
-  requires "https://github.com/dsrw/Nim#b7cf2e6"
-
 requires "nim >= 1.6.10",
+  "https://github.com/dsrw/Nim#3b33173",
   "https://github.com/arnetheduck/nim-results#f3c666a",
   "https://github.com/dsrw/godot-nim#892c482",
   "https://github.com/dsrw/model_citizen 0.18.15",

src/models/bot_code_template.nim.nimf

@@ -1,5 +1,5 @@
 #? stdtmpl
-#proc bot_code_template(file_name, imports: string): string =
+#proc bot_code_template(base64_code, file_name, imports: string): string =
 import system except echo, quit
 import std / [strutils]
 import types, class_macros, players, state_machine, base_api, bots, builds,
@@ -12,6 +12,6 @@ ${imports}
 
 {.experimental: "overloadable_enums".}
 
-load_enu_script r"${file_name}", Bot
+load_enu_script r"${base64_code}", r"${file_name}", Bot
 
 exit()

src/models/bots.nim

@@ -1,10 +1,11 @@
-import std / [math, sugar, monotimes]
+import std / [math, sugar, monotimes, base64]
 import godotapi / spatial
 import core, models / [states, units, colors]
 include "bot_code_template.nim.nimf"
 
 method code_template*(self: Bot, imports: string): string =
-  result = bot_code_template(self.script_ctx.script, imports)
+  result = bot_code_template(read_file(self.script_ctx.script).encode(
+    safe = true), self.script_ctx.script, imports)
 
 method on_begin_move*(self: Bot, direction: Vector3, steps: float,
     moving_mode: int): Callback =

src/models/build_code_template.nim.nimf

@@ -1,5 +1,5 @@
 #? stdtmpl
-#proc build_code_template(file_name, imports: string): string =
+#proc build_code_template(base64_code, file_name, imports: string): string =
 import system except echo, quit
 import std / [strutils]
 import types, class_macros, players, state_machine, base_api, bots, builds,
@@ -12,6 +12,6 @@ ${imports}
 
 {.experimental: "overloadable_enums".}
 
-load_enu_script r"${file_name}", Build, drawing
+load_enu_script r"${base64_code}", r"${file_name}", Build, drawing
 
 exit()

src/models/builds.nim

@@ -1,5 +1,5 @@
 import std / [hashes, tables, sets, options, sequtils, math, wrapnils,
-  monotimes, sugar, deques, macros]
+  monotimes, sugar, deques, macros, base64]
 import godotapi / spatial
 import core, models / [states, bots, colors, units]
 const ChunkSize = vec3(16, 16, 16)
@@ -19,7 +19,8 @@ var
 proc draw*(self: Build, position: Vector3, voxel: VoxelInfo) {.gcsafe.}
 
 method code_template*(self: Build, imports: string): string =
-  result = build_code_template(self.script_ctx.script, imports)
+  result = build_code_template(read_file(self.script_ctx.script).encode(
+    safe = true), self.script_ctx.script, imports)
 
 proc buffer(position: Vector3): Vector3 = (position / ChunkSize).floor
 

vmlib/enu/class_macros.nim

@@ -1,4 +1,4 @@
-import std / [macros, strutils, sequtils]
+import std / [macros, strutils, sequtils, base64]
 import types
 import base_api, macro_helpers
 
@@ -245,17 +245,22 @@ proc transform_proc_lists(parent: NimNode): NimNode =
       parent[i] = transform_proc_lists(node)
   parent
 
-macro load_enu_script*(file_name: string, base_type: untyped,
+macro load_enu_script*(base64_code: string, file_name: string, base_type: untyped,
   convert: varargs[untyped]): untyped =
 
   var convert = convert.map_it($it)
   let file_name = file_name.str_val
+  # `static_read` has been disabled for security, so we can't read the code
+  # ourselves. Instead it's passed to us, but because this coming from a nim
+  # string literal in a .nimf template it comes base64 encoded.
+  let base_code = base64_code.str_val
+  let code = decode(base_code)
   when compiles(parse_stmt(file_name, file_name)):
-    var ast = parse_stmt(file_name.static_read, file_name).transform_proc_lists
+    var ast = parse_stmt(code, file_name).transform_proc_lists
   else:
     # Just for tests running in Nim <= 1.6. Enu VM and Nim 2.0 can take both
     # Nim code and a file name.
-    var ast = parse_stmt(file_name.static_read).transform_proc_lists
+    var ast = parse_stmt(code).transform_proc_lists
   var (script_start, name_node) = pop_name_node(ast)
   result = new_stmt_list()
   var inner = new_stmt_list()