I want to be able to dynamically retrieve a variable. Basically just parse each input for variables twice.
I’d want it for something like this flow:
https://inventor.gg/dash/share/component/0c75eb11f1404020a3cd828e185e721a
With this global var:
Or this flow:
https://inventor.gg/dash/share/component/7177d54f7f6a4ca7b141a81278c8bae0
And if this is a security risk then can you find a way to make it not one? :)
There is no way to do this without it being a security risk, unless you have a way to entirely eliminate untrusted or sensitive content from variables.
There is fundamentally no difference between having something like this:
[[ 0.[[ 0.Example ]] ]]
[[ 0.Author ID ]]
123456789123456
And this:
[[ 0.Message Content ]]
[[ 123.Bot Token ]]
bottokenabcxyz
There are mitigations, but no generalised solution that fully hardens parsing against injection attacks, if you allow sequential or repeated parses.
For global variables, you can just use the get global variable block to retrieve them dynamically.
A similar block for local variables may be a way to subvert this, but that really feels like building and loading a footgun. I worry that even long-time Inventor users wouldn’t fully understand the potential for misuse and would pipe untrusted content (maybe without realizing) into it anyway.
Hmm true, idk how to combat that easily.