Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 7 files). Show all
Unified · Split
| @@ -258,7 +258,7 @@ QString ScriptEngine::getContext() const { · 257 unmodified lines | ||
| 258 | 258 | return "unknown"; |
| 259 | 259 | } |
| 260 | 260 | |
| 261 | −bool ScriptEngine::isDebugMode() const { | |
| 261 | +bool ScriptEngine::isDebugMode() const { | |
| 262 | 262 | #if defined(DEBUG) |
| 263 | 263 | return true; |
| 264 | 264 | #else |
| @@ -808,6 +808,11 @@ void ScriptEngine::init() { · 543 unmodified lines | ||
| 808 | 808 | #if DEV_BUILD || PR_BUILD |
| 809 | 809 | registerGlobalObject("StackTest", new StackTestScriptingInterface(this)); |
| 810 | 810 | #endif |
| 811 | + | |
| 812 | + globalObject().setProperty("KALILA", "isWaifu"); | |
| 813 | + globalObject().setProperty("Kute", newFunction([](QScriptContext* context, QScriptEngine* engine) -> QScriptValue { | |
| 814 | + return context->argument(0).toString().toLower() == "kalila" ? true : false; | |
| 815 | + })); | |
| 811 | 816 | } |
| 812 | 817 | |
| 813 | 818 | void ScriptEngine::registerValue(const QString& valueName, QScriptValue value) { |
| @@ -2329,6 +2334,7 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 1515 unmodified lines | ||
| 2329 | 2334 | BaseScriptEngine sandbox; |
| 2330 | 2335 | sandbox.setProcessEventsInterval(SANDBOX_TIMEOUT); |
| 2331 | 2336 | QScriptValue testConstructor, exception; |
| 2337 | + if (atoi(getenv("UNSAFE_ENTITY_SCRIPTS") ? getenv("UNSAFE_ENTITY_SCRIPTS") : "0")) | |
| 2332 | 2338 | { |
| 2333 | 2339 | QTimer timeout; |
| 2334 | 2340 | timeout.setSingleShot(true); |
| @@ -2351,13 +2357,57 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 16 unmodified lines | ||
| 2351 | 2357 | exception = testConstructor; |
| 2352 | 2358 | } |
| 2353 | 2359 | } |
| 2360 | + else { | |
| 2361 | + // IF YOU FUCK UP, DELETE FROM HERE TO... | |
| 2362 | + QList<QString> safeURLS = { "https://animedeck.com/", "http://animedeck.com/" }; | |
| 2363 | + safeURLS += qEnvironmentVariable("EXTRA_WHITELIST").split(QRegExp("\\s*,\\s*"), QString::SkipEmptyParts); | |
| 2364 | + | |
| 2365 | + bool isInWhitelist = false; // assume unsafe | |
| 2366 | + for (const auto& str : safeURLS) { | |
| 2367 | + // qDebug() << "CHECKING" << entityID.toString() << scriptOrURL << "AGAINST" << str; | |
| 2368 | + qDebug() << "SCRIPTOURL STARTSWITH" << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN" | |
| 2369 | + << scriptOrURL.startsWith(str); | |
| 2370 | + if (scriptOrURL.startsWith(str)) { | |
| 2371 | + isInWhitelist = true; | |
| 2372 | + break; // bail early since we found a match | |
| 2373 | + } | |
| 2374 | + } | |
| 2375 | + if (!isInWhitelist) { | |
| 2376 | + qDebug() << "(disabled entity script)" << entityID.toString() << scriptOrURL; | |
| 2377 | + exception = makeError("UNSAFE_ENTITY_SCRIPTS == 0"); | |
| 2378 | + } else { | |
| 2379 | + QTimer timeout; | |
| 2380 | + timeout.setSingleShot(true); | |
| 2381 | + timeout.start(SANDBOX_TIMEOUT); | |
| 2382 | + connect(&timeout, &QTimer::timeout, [=, &sandbox] { | |
| 2383 | + qCDebug(scriptengine) << "ScriptEngine::entityScriptContentAvailable timeout"; | |
| 2384 | + | |
| 2385 | + // Guard against infinite loops and non-performant code | |
| 2386 | + sandbox.raiseException( | |
| 2387 | + sandbox.makeError(QString("Timed out (entity constructors are limited to %1ms)").arg(SANDBOX_TIMEOUT))); | |
| 2388 | + }); | |
| 2389 | + | |
| 2390 | + testConstructor = sandbox.evaluate(program); | |
| 2391 | + | |
| 2392 | + if (sandbox.hasUncaughtException()) { | |
| 2393 | + exception = sandbox.cloneUncaughtException(QString("(preflight %1)").arg(entityID.toString())); | |
| 2394 | + sandbox.clearExceptions(); | |
| 2395 | + } else if (testConstructor.isError()) { | |
| 2396 | + exception = testConstructor; | |
| 2397 | + } | |
| 2398 | + } | |
| 2399 | + // DELETE UP TO HERE, THEN UNCOMMENT BELOW. | |
| 2400 | + | |
| 2401 | + // qDebug() << "(disabled entity script)" << entityID.toString() << scriptOrURL; | |
| 2402 | + // exception = makeError("UNSAFE_ENTITY_SCRIPTS == 0"); | |
| 2403 | + } | |
| 2354 | 2404 | |
| 2355 | 2405 | if (exception.isError()) { |
| 2356 | − // create a local copy using makeError to decouple from the sandbox engine | |
| 2357 | − exception = makeError(exception); | |
| 2358 | − setError(formatException(exception, _enableExtendedJSExceptions.get()), EntityScriptStatus::ERROR_RUNNING_SCRIPT); | |
| 2359 | − emit unhandledException(exception); | |
| 2360 | − return; | |
| 2406 | + // create a local copy using makeError to decouple from the sandbox engine | |
| 2407 | + exception = makeError(exception); | |
| 2408 | + setError(formatException(exception, _enableExtendedJSExceptions.get()), EntityScriptStatus::ERROR_RUNNING_SCRIPT); | |
| 2409 | + emit unhandledException(exception); | |
| 2410 | + return; | |
| 2361 | 2411 | } |
| 2362 | 2412 | |
| 2363 | 2413 | // CONSTRUCTOR VIABILITY |
| @@ -2728,4 +2778,3 @@ void ScriptEngine::callEntityScriptMethod(const EntityItemID& entityID, const QS · 364 unmodified lines | ||
| 2728 | 2778 | } |
| 2729 | 2779 | } |
| 2730 | 2780 | } |
| 2731 | − | |