Object security

Object security traits are protections employed by user interface objects to restrict actions that can be taken by insecure code, such as addons.

Introduced in Patch 2.0.1, protected regions disallow the modification of secure execution attributes, positioning information, sizing, and visibility of regions during combat from insecure code.

• A common example of protected regions are Action bar buttons and Unit frames.
• The method can be used to query if a region will be protected in combat.
• For additional information, refer to Secure Execution and Tainting.

Introduced in Patch 5.4.0, forbidden objects disallow insecure code from calling almost all methods on objects under all circumstances.

• Forbidden objects were first implemented to protect the In-Game Store.
• The method can be used to query if an object is forbidden.
• The only other methods accessible to insecure code on forbidden objects are and.
• Forbidden objects are not returned by functions such as and.

Introduced in Patch 8.2.0, anchor restricted regions disallow the querying of positional information of regions from insecure code, and the creation of anchors that would result in a region being positioned relative to two distinct anchor families simultaneously.

• A common example of anchor restricted regions are nameplates and chat bubbles.
• The method can be used to query if a region is anchor restricted.
• Methods that query positional information such as and cannot be called from insecure code.
• Methods that modify anchor points such as will fail with a forbidden action error if the resultant set of anchors would bridge two separate anchor families.
• In most cases, this will trigger if attempting to anchor a restricted region to both the screen and UIParent. This can often be avoided by first calling.

Introduced in Patch 10.1.0, inaccessible objects are entities for which a reference cannot be obtained through any object methods, and whose named identity may be obscured.

• Inaccessible regions are used by the Private Auras UI.
• At present there is no dedicated method through which a region can be tested for inaccessibility.
• The method will always return a string of the form "$parent.inaccessible", with ".inaccessible" being repeated for each inaccessible and unnamed parent object in the object tree.
• The method will always return nil.
• The and methods will never return inaccessible child objects even if the caller is secure.