Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 1 file). Show all
Unified · Split
| @@ -86,6 +86,8 @@ · 85 unmodified lines | |||
| 86 | 86 | ||
| 87 | #include "SettingHandle.h" | 87 | #include "SettingHandle.h" |
| 88 | #include <AddressManager.h> | 88 | #include <AddressManager.h> |
| 89 | #include <NetworkingConstants.h> | ||
| 90 | |||
| 89 | 91 | ||
| 90 | const QString ScriptEngine::_SETTINGS_ENABLE_EXTENDED_EXCEPTIONS { | 92 | const QString ScriptEngine::_SETTINGS_ENABLE_EXTENDED_EXCEPTIONS { |
| 91 | "com.highfidelity.experimental.enableExtendedJSExceptions" | 93 | "com.highfidelity.experimental.enableExtendedJSExceptions" |
| @@ -2359,14 +2361,13 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 2267 unmodified lines | |||
| 2359 | } else if (testConstructor.isError()) { | 2361 | } else if (testConstructor.isError()) { |
| 2360 | exception = testConstructor; | 2362 | exception = testConstructor; |
| 2361 | } | 2363 | } |
| 2362 | } | 2364 | } else { |
| 2363 | else { | ||
| 2364 | // ENTITY SCRIPT WHITELIST STARTS HERE | 2365 | // ENTITY SCRIPT WHITELIST STARTS HERE |
| 2365 | auto nodeList = DependencyManager::get<NodeList>(); | 2366 | auto nodeList = DependencyManager::get<NodeList>(); |
| 2366 | bool passList = false; // assume unsafe | 2367 | bool passList = false; // assume unsafe |
| 2367 | QString whitelistPrefix = "[WHITELIST ENTITY SCRIPTS]"; | 2368 | QString whitelistPrefix = "[WHITELIST ENTITY SCRIPTS]"; |
| 2368 | QList<QString> safeURLS = { "file:///", "atp:", "cache:" }; | 2369 | QList<QString> safeURLPrefixes = { "file:///", "atp:", "cache:" }; |
| 2369 | safeURLS += qEnvironmentVariable("EXTRA_WHITELIST").trimmed().split(QRegExp("\\s*,\\s*"), QString::SkipEmptyParts); | 2370 | safeURLPrefixes += qEnvironmentVariable("EXTRA_WHITELIST").trimmed().split(QRegExp("\\s*,\\s*"), QString::SkipEmptyParts); |
| 2370 | 2371 | ||
| 2371 | // IF WHITELIST IS DISABLED IN SETTINGS | 2372 | // IF WHITELIST IS DISABLED IN SETTINGS |
| 2372 | bool whitelistEnabled = Setting::Handle<bool>("private/whitelistEnabled", true).get(); | 2373 | bool whitelistEnabled = Setting::Handle<bool>("private/whitelistEnabled", true).get(); |
| @@ -2377,15 +2378,15 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 4 unmodified lines | |||
| 2377 | // PULL SAFEURLS FROM INTERFACE.JSON Settings | 2378 | // PULL SAFEURLS FROM INTERFACE.JSON Settings |
| 2378 | QVariant raw = Setting::Handle<QVariant>("private/settingsSafeURLS").get(); | 2379 | QVariant raw = Setting::Handle<QVariant>("private/settingsSafeURLS").get(); |
| 2379 | QStringList settingsSafeURLS = raw.toString().trimmed().split(QRegExp("\\s*[,\r\n]+\\s*"), QString::SkipEmptyParts); | 2380 | QStringList settingsSafeURLS = raw.toString().trimmed().split(QRegExp("\\s*[,\r\n]+\\s*"), QString::SkipEmptyParts); |
| 2380 | safeURLS += settingsSafeURLS; | 2381 | safeURLPrefixes += settingsSafeURLS; |
| 2381 | // END PULL SAFEURLS FROM INTERFACE.JSON Settings | 2382 | // END PULL SAFEURLS FROM INTERFACE.JSON Settings |
| 2382 | 2383 | ||
| 2383 | // GET CURRENT DOMAIN WHITELIST BYPASS, IN CASE AN ENTIRE DOMAIN IS WHITELISTED | 2384 | // GET CURRENT DOMAIN WHITELIST BYPASS, IN CASE AN ENTIRE DOMAIN IS WHITELISTED |
| 2384 | QString currentDomain = DependencyManager::get<AddressManager>()->getDomainURL().host(); | 2385 | QString currentDomain = DependencyManager::get<AddressManager>()->getDomainURL().host(); |
| 2385 | 2386 | ||
| 2386 | QString domainSafeIP = nodeList->getDomainHandler().getHostname(); | 2387 | QString domainSafeIP = nodeList->getDomainHandler().getHostname(); |
| 2387 | QString domainSafeURL = "hifi://" + currentDomain; | 2388 | QString domainSafeURL = URL_SCHEME_HIFI + "://" + currentDomain; |
| 2388 | for (const auto& str : safeURLS) { | 2389 | for (const auto& str : safeURLPrefixes) { |
| 2389 | if (domainSafeURL.startsWith(str) || domainSafeIP.startsWith(str)) { | 2390 | if (domainSafeURL.startsWith(str) || domainSafeIP.startsWith(str)) { |
| 2390 | qCDebug(scriptengine) << whitelistPrefix << "Whitelist Bypassed. Current Domain Host: " | 2391 | qCDebug(scriptengine) << whitelistPrefix << "Whitelist Bypassed. Current Domain Host: " |
| 2391 | << nodeList->getDomainHandler().getHostname() | 2392 | << nodeList->getDomainHandler().getHostname() |
| @@ -2399,7 +2400,7 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 7 unmodified lines | |||
| 2399 | if (ScriptEngine::getContext() == "entity_server") { // If running on the server, do not engage whitelist. | 2400 | if (ScriptEngine::getContext() == "entity_server") { // If running on the server, do not engage whitelist. |
| 2400 | passList = true; | 2401 | passList = true; |
| 2401 | } else if (!passList) { // If waved through, do not engage whitelist. | 2402 | } else if (!passList) { // If waved through, do not engage whitelist. |
| 2402 | for (const auto& str : safeURLS) { | 2403 | for (const auto& str : safeURLPrefixes) { |
| 2403 | qCDebug(scriptengine) << whitelistPrefix << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN" | 2404 | qCDebug(scriptengine) << whitelistPrefix << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN" |
| 2404 | << scriptOrURL.startsWith(str); | 2405 | << scriptOrURL.startsWith(str); |
| 2405 | if (!str.isEmpty() && scriptOrURL.startsWith(str)) { | 2406 | if (!str.isEmpty() && scriptOrURL.startsWith(str)) { |