You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Enum choices should be updated to only use the name. This makes the actual enum value hidden and allows more complex, non-serializable, values possible to store in the enum.
Description
Currently Enums can be used to type options for application command options but it is restricted to integers, floats, and strings. This is because the actual value of the Enum gets sent to Discord as the choice value.
Theoretically, this also presents a security risk if a user were to have sensitive information in the enum value - not expecting it to be sent to Discord. Even though the value isn't presented in the UI, it is not clear whether self-bots are able to access it.
While implementing this change, the converter attribute of Option should most likely be removed/renamed, to better fit the specific purpose of getting an Enum instance from the value returned by Discord. Perhaps that information should be moved to the type instance of the Option.
The text was updated successfully, but these errors were encountered:
Summary
Enum choices should be updated to only use the name. This makes the actual enum value hidden and allows more complex, non-serializable, values possible to store in the enum.
Description
Currently Enums can be used to type options for application command options but it is restricted to integers, floats, and strings. This is because the actual value of the Enum gets sent to Discord as the choice value.
Theoretically, this also presents a security risk if a user were to have sensitive information in the enum value - not expecting it to be sent to Discord. Even though the value isn't presented in the UI, it is not clear whether self-bots are able to access it.
To solve both of these problems the enum code should be changed to set the choice value to the enum name and then instead use item access as explained by the documentation:
While implementing this change, the
converter
attribute ofOption
should most likely be removed/renamed, to better fit the specific purpose of getting an Enum instance from the value returned by Discord. Perhaps that information should be moved to thetype
instance of theOption
.The text was updated successfully, but these errors were encountered: