Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 1 file). Show all
Unified · Split
| @@ -86,6 +86,8 @@ · 85 unmodified lines | ||
| 86 | 86 | |
| 87 | 87 | #include "SettingHandle.h" |
| 88 | 88 | #include <AddressManager.h> |
| 89 | +#include <NetworkingConstants.h> | |
| 90 | + | |
| 89 | 91 | |
| 90 | 92 | const QString ScriptEngine::_SETTINGS_ENABLE_EXTENDED_EXCEPTIONS { |
| 91 | 93 | "com.highfidelity.experimental.enableExtendedJSExceptions" |
| @@ -2359,14 +2361,13 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 2267 unmodified lines | ||
| 2359 | 2361 | } else if (testConstructor.isError()) { |
| 2360 | 2362 | exception = testConstructor; |
| 2361 | 2363 | } |
| 2362 | − } | |
| 2363 | − else { | |
| 2364 | + } else { | |
| 2364 | 2365 | // ENTITY SCRIPT WHITELIST STARTS HERE |
| 2365 | 2366 | auto nodeList = DependencyManager::get<NodeList>(); |
| 2366 | 2367 | bool passList = false; // assume unsafe |
| 2367 | 2368 | QString whitelistPrefix = "[WHITELIST ENTITY SCRIPTS]"; |
| 2368 | − QList<QString> safeURLS = { "file:///", "atp:", "cache:" }; | |
| 2369 | − safeURLS += qEnvironmentVariable("EXTRA_WHITELIST").trimmed().split(QRegExp("\\s*,\\s*"), QString::SkipEmptyParts); | |
| 2369 | + QList<QString> safeURLPrefixes = { "file:///", "atp:", "cache:" }; | |
| 2370 | + safeURLPrefixes += qEnvironmentVariable("EXTRA_WHITELIST").trimmed().split(QRegExp("\\s*,\\s*"), QString::SkipEmptyParts); | |
| 2370 | 2371 | |
| 2371 | 2372 | // IF WHITELIST IS DISABLED IN SETTINGS |
| 2372 | 2373 | bool whitelistEnabled = Setting::Handle<bool>("private/whitelistEnabled", true).get(); |
| @@ -2377,15 +2378,15 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 4 unmodified lines | ||
| 2377 | 2378 | // PULL SAFEURLS FROM INTERFACE.JSON Settings |
| 2378 | 2379 | QVariant raw = Setting::Handle<QVariant>("private/settingsSafeURLS").get(); |
| 2379 | 2380 | QStringList settingsSafeURLS = raw.toString().trimmed().split(QRegExp("\\s*[,\r\n]+\\s*"), QString::SkipEmptyParts); |
| 2380 | − safeURLS += settingsSafeURLS; | |
| 2381 | + safeURLPrefixes += settingsSafeURLS; | |
| 2381 | 2382 | // END PULL SAFEURLS FROM INTERFACE.JSON Settings |
| 2382 | 2383 | |
| 2383 | 2384 | // GET CURRENT DOMAIN WHITELIST BYPASS, IN CASE AN ENTIRE DOMAIN IS WHITELISTED |
| 2384 | 2385 | QString currentDomain = DependencyManager::get<AddressManager>()->getDomainURL().host(); |
| 2385 | 2386 | |
| 2386 | 2387 | QString domainSafeIP = nodeList->getDomainHandler().getHostname(); |
| 2387 | − QString domainSafeURL = "hifi://" + currentDomain; | |
| 2388 | − for (const auto& str : safeURLS) { | |
| 2388 | + QString domainSafeURL = URL_SCHEME_HIFI + "://" + currentDomain; | |
| 2389 | + for (const auto& str : safeURLPrefixes) { | |
| 2389 | 2390 | if (domainSafeURL.startsWith(str) || domainSafeIP.startsWith(str)) { |
| 2390 | 2391 | qCDebug(scriptengine) << whitelistPrefix << "Whitelist Bypassed. Current Domain Host: " |
| 2391 | 2392 | << nodeList->getDomainHandler().getHostname() |
| @@ -2399,7 +2400,7 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 7 unmodified lines | ||
| 2399 | 2400 | if (ScriptEngine::getContext() == "entity_server") { // If running on the server, do not engage whitelist. |
| 2400 | 2401 | passList = true; |
| 2401 | 2402 | } else if (!passList) { // If waved through, do not engage whitelist. |
| 2402 | − for (const auto& str : safeURLS) { | |
| 2403 | + for (const auto& str : safeURLPrefixes) { | |
| 2403 | 2404 | qCDebug(scriptengine) << whitelistPrefix << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN" |
| 2404 | 2405 | << scriptOrURL.startsWith(str); |
| 2405 | 2406 | if (!str.isEmpty() && scriptOrURL.startsWith(str)) { |