From a09ba9356a5796a1a5c0558c1334fa0ebd5d2e1f Mon Sep 17 00:00:00 2001
From: y5nw <37980625+y5nw@users.noreply.github.com>
Date: Sun, 19 Apr 2026 21:32:08 +0200
Subject: [PATCH 1/2] Disallow string concatenations in the GPU fakeshader

---
 gpu.lua | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gpu.lua b/gpu.lua
index 590e413..735f3b1 100644
--- a/gpu.lua
+++ b/gpu.lua
@@ -764,6 +764,8 @@ local function runcommand(pos, meta, command)
 
 		if command.code:find('"', 1, true) or command.code:find("%[=*%[") then
 			return false, "Cannot create strings in shader code"
+		elseif command.code:find("..", 1, true) then
+			return false, "Cannot concatenate strings in shader code"
 		end
 
 		local ok, f, errmsg

From 5bc68a238782f6857ff32f2553f0aac5dcf244be Mon Sep 17 00:00:00 2001
From: y5nw <37980625+y5nw@users.noreply.github.com>
Date: Sun, 19 Apr 2026 22:09:36 +0200
Subject: [PATCH 2/2] Disallow string creation with single quotes

---
 gpu.lua | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gpu.lua b/gpu.lua
index 735f3b1..c06d0ee 100644
--- a/gpu.lua
+++ b/gpu.lua
@@ -762,7 +762,7 @@ local function runcommand(pos, meta, command)
 		-- (mod security disallows bytecode)
 		if command.code:byte(1) == 27 then return false, "No bytecode" end
 
-		if command.code:find('"', 1, true) or command.code:find("%[=*%[") then
+		if command.code:find('"', 1, true) or command.code:find("'", 1, true) or command.code:find("%[=*%[") then
 			return false, "Cannot create strings in shader code"
 		elseif command.code:find("..", 1, true) then
 			return false, "Cannot concatenate strings in shader code"