All right, so what is secure function hooking and why is it used?
What is taint?
I have only a cursory view of this, being mainly a pre-2.0 addon author (and not doing much of anything except non-tainting-related coding in 2.0+, mainly my SpellChecker2 - aka "Rose Tinted Glasses for the Grammatically Sensitive").
First, a small history lesson - in the times of yore, when Frost Mages ruled the damage meters in MC and Alterac Valley was a longlasting affair, people hooked Blizzard functions for fun and profit. This was done for one of two reasons - changing their functionality ("no, you may NOT cancel your flask buff!") and for informational purposes ("so, trying to cancel Flask buffs, are we? <sends a whisper to raid leader about sexual preference>").
Secure function hooking (
hooksecurefunc) is used for the latter of these - when you want to be notified that a certain function has been called and with what parameters it was called - for instance, that a certain message has been sent in a whisper by the user.
You can no longer prevent Blizzard functions from doing their stuff without tainting them.
However, a quick info about what ZAutoStrip - it does not seem to actually hook any secure functions, it merely tries to use them.
Writing "local a = PickupContainerItem;" simply means that doing "a(16)" is the same as writing "PickupContainerItem(16)" - my assumption is that ZAutoStrip was first conceived as a Blizzard macro, where the amount of characters you use has an impact.
Or perhaps the author likes short function names.
In any case, the code you have cited should not cause any taint.
Do note, however, that what
hooksecurefunc("PickupInventoryItem", ZAutoStripUnequipValuables);
does is to make the ZAutoStripUnequipValuables function be called after every call to PickupInventoryItem. This is probably a bad thing.
Over to "taint" and why it is bad (and not just for the people allergic to demons).
Taint is imposed when a non-Blizzard-certified piece of code modifies a Blizzard-certified piece of code. The places where changes are made are flagged as "tainted" (as is, incidentally, all non-Blizzard-certified code AFAIK).
When the LUA interpreter runs a chunk of code, and it encounters a tainted piece, all code that runs from then on in that particular chunk is considered to be in a tainted state (and can no longer do no-taint-only cool stuff).
Example (non-real) piece of Blizzard code:
function Blizzard_CoolStuff(a)
if ( Blizzard_DoFunkyCheck() ) and ( a == 2 ) then
Blizzard_PerformCoolStuff(a);
end
Blizzard_PokeFunAtRaiders();
end
Now, if we change Blizzard_DoFunkyCheck with our evil, tainted paw, Blizzard_PerformCoolStuff (which requires non-tainted state) will not work nor will Blizzard_PokeFunAtRaiders.
If, however, Blizzard_PerformCoolStuff is tainted, but actually not used (a == 1), then Blizzard_PokeFunAtRaiders can be run without any taint.
I hope this has shed some light on taint and secure function hooking.
If I am wrong in my assumptions, then I would ask that someone with more knowledge mock me and respond with a better explanation.