Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 1 file). Show all
Unified · Split
| @@ -2361,10 +2361,9 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 2360 unmodified lines | ||
| 2361 | 2361 | } |
| 2362 | 2362 | } |
| 2363 | 2363 | else { |
| 2364 | − // ENTITY SCRIPT WHITELIST STARTS HERE | |
| 2364 | + // ENTITY SCRIPT WHITELIST STARTS HERE | |
| 2365 | 2365 | auto nodeList = DependencyManager::get<NodeList>(); |
| 2366 | − bool isInWhitelist = false; // assume unsafe | |
| 2367 | − bool autoPassList = false; | |
| 2366 | + bool passList = false; // assume unsafe | |
| 2368 | 2367 | QString whitelistPrefix = "[WHITELIST ENTITY SCRIPTS]"; |
| 2369 | 2368 | QList<QString> safeURLS = { "file:///", "atp:", "cache:" }; |
| 2370 | 2369 | safeURLS += qEnvironmentVariable("EXTRA_WHITELIST").trimmed().split(QRegExp("\\s*,\\s*"), QString::SkipEmptyParts); |
| @@ -2372,14 +2371,13 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 1 unmodified line | ||
| 2372 | 2371 | // IF WHITELIST IS DISABLED IN SETTINGS |
| 2373 | 2372 | bool whitelistEnabled = Setting::Handle<bool>("private/whitelistEnabled", true).get(); |
| 2374 | 2373 | if (!whitelistEnabled) { |
| 2375 | − autoPassList = true; | |
| 2374 | + passList = true; | |
| 2376 | 2375 | } |
| 2377 | − // PULL SAFEURLS FROM INTERFACE.JSON Settings | |
| 2378 | 2376 | |
| 2377 | + // PULL SAFEURLS FROM INTERFACE.JSON Settings | |
| 2379 | 2378 | QVariant raw = Setting::Handle<QVariant>("private/settingsSafeURLS").get(); |
| 2380 | 2379 | QStringList settingsSafeURLS = raw.toString().trimmed().split(QRegExp("\\s*[,\r\n]+\\s*"), QString::SkipEmptyParts); |
| 2381 | 2380 | safeURLS += settingsSafeURLS; |
| 2382 | − | |
| 2383 | 2381 | // END PULL SAFEURLS FROM INTERFACE.JSON Settings |
| 2384 | 2382 | |
| 2385 | 2383 | // GET CURRENT DOMAIN WHITELIST BYPASS, IN CASE AN ENTIRE DOMAIN IS WHITELISTED |
| @@ -2392,27 +2390,28 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 6 unmodified lines | ||
| 2392 | 2390 | qCDebug(scriptengine) << whitelistPrefix << "Whitelist Bypassed. Current Domain Host: " |
| 2393 | 2391 | << nodeList->getDomainHandler().getHostname() |
| 2394 | 2392 | << "Current Domain: " << currentDomain; |
| 2395 | − isInWhitelist = true; | |
| 2396 | − autoPassList = true; | |
| 2393 | + passList = true; | |
| 2397 | 2394 | } |
| 2398 | 2395 | } |
| 2399 | 2396 | // END CURRENT DOMAIN WHITELIST BYPASS |
| 2400 | 2397 | |
| 2401 | − if (ScriptEngine::getContext() == "entity_server" || autoPassList == true) { // If running on the server or waved through, do not engage whitelist. | |
| 2402 | − isInWhitelist = true; | |
| 2398 | + // START CHECKING AGAINST THE WHITELIST | |
| 2399 | + if (ScriptEngine::getContext() == "entity_server" || passList == true) { // If running on the server or waved through, do not engage whitelist. | |
| 2400 | + passList = true; | |
| 2403 | 2401 | } else { |
| 2404 | 2402 | for (const auto& str : safeURLS) { |
| 2405 | 2403 | qCDebug(scriptengine) << whitelistPrefix << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN" |
| 2406 | 2404 | << scriptOrURL.startsWith(str); |
| 2407 | 2405 | if (!str.isEmpty() && scriptOrURL.startsWith(str)) { |
| 2408 | − isInWhitelist = true; | |
| 2406 | + passList = true; | |
| 2409 | 2407 | qCDebug(scriptengine) << whitelistPrefix << "Script approved."; |
| 2410 | 2408 | break; // bail early since we found a match |
| 2411 | 2409 | } |
| 2412 | 2410 | } |
| 2413 | 2411 | } |
| 2412 | + // END CHECKING AGAINST THE WHITELIST | |
| 2414 | 2413 | |
| 2415 | − if (!isInWhitelist || autoPassList == false) { | |
| 2414 | + if (!passList) { // If the entity failed to pass for any reason, it's blocked and an error is thrown. | |
| 2416 | 2415 | qCDebug(scriptengine) << whitelistPrefix << "(disabled entity script)" << entityID.toString() << scriptOrURL; |
| 2417 | 2416 | exception = makeError("UNSAFE_ENTITY_SCRIPTS == 0"); |
| 2418 | 2417 | } else { |