History

Fixes bug where empty "" whitespace allows all scripts.

Kasen IO committed 6 years ago

Commit 2de388a1 parent fe66dc81 file · +6 −7Browse files

Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 1 file). Show all

Unified · Split

libraries/script-engine/src/ScriptEngine.cpp+6−7
@@ -2363,24 +2363,23 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 2362 unmodified lines
2363 }2363 }
2364 }2364 }
2365 else {2365 else {
2366 // IF YOU FUCK UP, DELETE FROM HERE TO...2366 // ENTITY SCRIPT WHITELIST STARTS HERE
2367 QList<QString> safeURLS = { "https://FAKEURL.t43wt4g4g44FAKE" };2367 QList<QString> safeURLS = { "" };
2368 safeURLS += qEnvironmentVariable("EXTRA_WHITELIST").split(QRegExp("\\s*,\\s*"), QString::SkipEmptyParts);2368 safeURLS += qEnvironmentVariable("EXTRA_WHITELIST").trimmed().split(QRegExp("\\s*,\\s*"), QString::SkipEmptyParts);
2369 2369
2370 // PULL SAFEURLS FROM INTERFACE.JSON Settings2370 // PULL SAFEURLS FROM INTERFACE.JSON Settings
2371 2371
2372 QVariant raw = Setting::Handle<QVariant>("private/settingsSafeURLS").get();2372 QVariant raw = Setting::Handle<QVariant>("private/settingsSafeURLS").get();
2373 QStringList settingsSafeURLS = raw.toString().split(QRegExp("\\s*[,\r\n]+\\s*"));2373 QStringList settingsSafeURLS = raw.toString().trimmed().split(QRegExp("\\s*[,\r\n]+\\s*"), QString::SkipEmptyParts);
2374 safeURLS += settingsSafeURLS;2374 safeURLS += settingsSafeURLS;
2375 2375
2376 // END PULL SAFEURLS FROM INTERFACE.JSON Settings2376 // END PULL SAFEURLS FROM INTERFACE.JSON Settings
2377 2377
2378 bool isInWhitelist = false; // assume unsafe2378 bool isInWhitelist = false; // assume unsafe
2379 for (const auto& str : safeURLS) {2379 for (const auto& str : safeURLS) {
2380 // qDebug() << "CHECKING" << entityID.toString() << scriptOrURL << "AGAINST" << str;
2381 qCDebug(scriptengine) << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN"2380 qCDebug(scriptengine) << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN"
2382 << scriptOrURL.startsWith(str);2381 << scriptOrURL.startsWith(str);
2383 if (scriptOrURL.startsWith(str)) {2382 if (!str.isEmpty() && scriptOrURL.startsWith(str)) {
2384 isInWhitelist = true;2383 isInWhitelist = true;
2385 qCDebug(scriptengine) << "Script approved.";2384 qCDebug(scriptengine) << "Script approved.";
2386 break; // bail early since we found a match2385 break; // bail early since we found a match
@@ -2410,7 +2409,7 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 23 unmodified lines
2410 exception = testConstructor;2409 exception = testConstructor;
2411 }2410 }
2412 }2411 }
2413 // DELETE UP TO HERE, THEN UNCOMMENT BELOW.2412 // ENTITY SCRIPT WHITELIST ENDS HERE, uncomment below for original full disabling.
2414 2413
2415 // qDebug() << "(disabled entity script)" << entityID.toString() << scriptOrURL;2414 // qDebug() << "(disabled entity script)" << entityID.toString() << scriptOrURL;
2416 // exception = makeError("UNSAFE_ENTITY_SCRIPTS == 0");2415 // exception = makeError("UNSAFE_ENTITY_SCRIPTS == 0");