From 0bfa45160f845427e7a729bfda47d45ca14187ab Mon Sep 17 00:00:00 2001
From: Hausec <33264718+hausec@users.noreply.github.com>
Date: Thu, 16 Apr 2026 21:41:54 -0400
Subject: [PATCH] Fix secret-string taint error on aura sourceUnit compare

In Midnight/Retail, auraData.sourceUnit can be returned as a "secret"
(tainted) string. Comparing it with == directly throws:

  attempt to compare local 'sourceUnit' (a secret string value tainted...)

The error fires from the blizzard-cooldowns path inside AuraButtonOnShow
when an aura from a non-player source shows up on the player buff frame.

Fix: prefer the boolean isFromPlayerOrPlayerPet field from auraData, and
fall back to the existing sourceUnit compare only after TPerl_CanAccess
confirms the value is not secret. Existing Classic/UnitAura path is
unaffected.
---
 TPerl/TPerl.lua | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/TPerl/TPerl.lua b/TPerl/TPerl.lua
index b988381..ba5529c 100644
--- a/TPerl/TPerl.lua
+++ b/TPerl/TPerl.lua
@@ -4106,13 +4106,14 @@ local function AuraButtonOnShow(self)
 		cd.countdown:SetTextColor(1, 1, 0)
 	end
 
-	local duration, expirationTime, sourceUnit
+	local duration, expirationTime, sourceUnit, isFromPlayerOrPlayerPet
 	if not IsVanillaClassic and C_UnitAuras then
 		local auraData = TPerl_SafeGetAuraDataByIndex("player", self.xindex, self.xfilter)
 		if auraData then
 			duration = TPerl_SafeTableGet(auraData, "duration")
 			expirationTime = TPerl_SafeTableGet(auraData, "expirationTime")
 			sourceUnit = TPerl_SafeTableGet(auraData, "sourceUnit")
+			isFromPlayerOrPlayerPet = TPerl_SafeTableGet(auraData, "isFromPlayerOrPlayerPet")
 		end
 	else
 		local _
@@ -4121,7 +4122,16 @@ local function AuraButtonOnShow(self)
 
 	if duration and expirationTime then
 		local start = expirationTime - duration
-		TPerl_CooldownFrame_SetTimer(self.cooldown, start, duration, 1, sourceUnit == "player")
+		-- sourceUnit may be a secret (tainted) value in Midnight/Retail; compare safely.
+		local isPlayerSource
+		if isFromPlayerOrPlayerPet ~= nil and TPerl_CanAccess(isFromPlayerOrPlayerPet) then
+			isPlayerSource = isFromPlayerOrPlayerPet and true or false
+		elseif TPerl_CanAccess(sourceUnit) then
+			isPlayerSource = (sourceUnit == "player")
+		else
+			isPlayerSource = false
+		end
+		TPerl_CooldownFrame_SetTimer(self.cooldown, start, duration, 1, isPlayerSource)
 	end
 end