Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 1 file). Show all
Unified · Split
| @@ -2363,24 +2363,23 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 2362 unmodified lines | ||
| 2363 | 2363 | } |
| 2364 | 2364 | } |
| 2365 | 2365 | else { |
| 2366 | − // IF YOU FUCK UP, DELETE FROM HERE TO... | |
| 2367 | − QList<QString> safeURLS = { "https://FAKEURL.t43wt4g4g44FAKE" }; | |
| 2368 | − safeURLS += qEnvironmentVariable("EXTRA_WHITELIST").split(QRegExp("\\s*,\\s*"), QString::SkipEmptyParts); | |
| 2366 | + // ENTITY SCRIPT WHITELIST STARTS HERE | |
| 2367 | + QList<QString> safeURLS = { "" }; | |
| 2368 | + safeURLS += qEnvironmentVariable("EXTRA_WHITELIST").trimmed().split(QRegExp("\\s*,\\s*"), QString::SkipEmptyParts); | |
| 2369 | 2369 | |
| 2370 | 2370 | // PULL SAFEURLS FROM INTERFACE.JSON Settings |
| 2371 | 2371 | |
| 2372 | 2372 | QVariant raw = Setting::Handle<QVariant>("private/settingsSafeURLS").get(); |
| 2373 | − QStringList settingsSafeURLS = raw.toString().split(QRegExp("\\s*[,\r\n]+\\s*")); | |
| 2373 | + QStringList settingsSafeURLS = raw.toString().trimmed().split(QRegExp("\\s*[,\r\n]+\\s*"), QString::SkipEmptyParts); | |
| 2374 | 2374 | safeURLS += settingsSafeURLS; |
| 2375 | 2375 | |
| 2376 | 2376 | // END PULL SAFEURLS FROM INTERFACE.JSON Settings |
| 2377 | 2377 | |
| 2378 | 2378 | bool isInWhitelist = false; // assume unsafe |
| 2379 | 2379 | for (const auto& str : safeURLS) { |
| 2380 | − // qDebug() << "CHECKING" << entityID.toString() << scriptOrURL << "AGAINST" << str; | |
| 2381 | 2380 | qCDebug(scriptengine) << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN" |
| 2382 | 2381 | << scriptOrURL.startsWith(str); |
| 2383 | − if (scriptOrURL.startsWith(str)) { | |
| 2382 | + if (!str.isEmpty() && scriptOrURL.startsWith(str)) { | |
| 2384 | 2383 | isInWhitelist = true; |
| 2385 | 2384 | qCDebug(scriptengine) << "Script approved."; |
| 2386 | 2385 | break; // bail early since we found a match |
| @@ -2410,7 +2409,7 @@ void ScriptEngine::entityScriptContentAvailable(const EntityItemID& entityID, co · 23 unmodified lines | ||
| 2410 | 2409 | exception = testConstructor; |
| 2411 | 2410 | } |
| 2412 | 2411 | } |
| 2413 | − // DELETE UP TO HERE, THEN UNCOMMENT BELOW. | |
| 2412 | + // ENTITY SCRIPT WHITELIST ENDS HERE, uncomment below for original full disabling. | |
| 2414 | 2413 | |
| 2415 | 2414 | // qDebug() << "(disabled entity script)" << entityID.toString() << scriptOrURL; |
| 2416 | 2415 | // exception = makeError("UNSAFE_ENTITY_SCRIPTS == 0"); |