Fix deleteLater() vulnerability in scripts
Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 2 files). Show all
Unified · Split
| @@ -66,6 +66,8 @@ · 65 unmodified lines | ||
| 66 | 66 | #include "MIDIEvent.h" |
| 67 | 67 | |
| 68 | 68 | static const QString SCRIPT_EXCEPTION_FORMAT = "[UncaughtException] %1 in %2:%3"; |
| 69 | +static const QScriptEngine::QObjectWrapOptions DEFAULT_QOBJECT_WRAP_OPTIONS = | |
| 70 | + QScriptEngine::ExcludeDeleteLater | QScriptEngine::ExcludeChildObjects; | |
| 69 | 71 | |
| 70 | 72 | Q_DECLARE_METATYPE(QScriptEngine::FunctionSignature) |
| 71 | 73 | int functionSignatureMetaID = qRegisterMetaType<QScriptEngine::FunctionSignature>(); |
| @@ -94,7 +96,7 @@ static QScriptValue debugPrint(QScriptContext* context, QScriptEngine* engine){ · 22 unmodified lines | ||
| 94 | 96 | } |
| 95 | 97 | |
| 96 | 98 | QScriptValue avatarDataToScriptValue(QScriptEngine* engine, AvatarData* const &in) { |
| 97 | − return engine->newQObject(in); | |
| 99 | + return engine->newQObject(in, QScriptEngine::QtOwnership, DEFAULT_QOBJECT_WRAP_OPTIONS); | |
| 98 | 100 | } |
| 99 | 101 | |
| 100 | 102 | void avatarDataFromScriptValue(const QScriptValue &object, AvatarData* &out) { |
| @@ -105,7 +107,7 @@ Q_DECLARE_METATYPE(controller::InputController*) · 4 unmodified lines | ||
| 105 | 107 | //static int inputControllerPointerId = qRegisterMetaType<controller::InputController*>(); |
| 106 | 108 | |
| 107 | 109 | QScriptValue inputControllerToScriptValue(QScriptEngine *engine, controller::InputController* const &in) { |
| 108 | − return engine->newQObject(in); | |
| 110 | + return engine->newQObject(in, QScriptEngine::QtOwnership, DEFAULT_QOBJECT_WRAP_OPTIONS); | |
| 109 | 111 | } |
| 110 | 112 | |
| 111 | 113 | void inputControllerFromScriptValue(const QScriptValue &object, controller::InputController* &out) { |
| @@ -459,7 +461,8 @@ static QScriptValue scriptableResourceToScriptValue(QScriptEngine* engine, const · 347 unmodified lines | ||
| 459 | 461 | |
| 460 | 462 | auto object = engine->newQObject( |
| 461 | 463 | const_cast<ScriptableResourceRawPtr>(resource), |
| 462 | − QScriptEngine::ScriptOwnership); | |
| 464 | + QScriptEngine::ScriptOwnership, | |
| 465 | + DEFAULT_QOBJECT_WRAP_OPTIONS); | |
| 463 | 466 | return object; |
| 464 | 467 | } |
| 465 | 468 | |
| @@ -478,7 +481,8 @@ static QScriptValue createScriptableResourcePrototype(QScriptEngine* engine) { · 12 unmodified lines | ||
| 478 | 481 | state->setProperty(metaEnum.key(i), metaEnum.value(i)); |
| 479 | 482 | } |
| 480 | 483 | |
| 481 | − auto prototypeState = engine->newQObject(state, QScriptEngine::QtOwnership, QScriptEngine::ExcludeSlots | QScriptEngine::ExcludeSuperClassMethods); | |
| 484 | + auto prototypeState = engine->newQObject(state, QScriptEngine::QtOwnership, | |
| 485 | + QScriptEngine::ExcludeDeleteLater | QScriptEngine::ExcludeSlots | QScriptEngine::ExcludeSuperClassMethods); | |
| 482 | 486 | prototype.setProperty("State", prototypeState); |
| 483 | 487 | |
| 484 | 488 | return prototype; |
| @@ -611,7 +615,7 @@ void ScriptEngine::registerGlobalObject(const QString& name, QObject* object) { · 126 unmodified lines | ||
| 611 | 615 | |
| 612 | 616 | if (!globalObject().property(name).isValid()) { |
| 613 | 617 | if (object) { |
| 614 | − QScriptValue value = newQObject(object); | |
| 618 | + QScriptValue value = newQObject(object, QScriptEngine::QtOwnership, DEFAULT_QOBJECT_WRAP_OPTIONS); | |
| 615 | 619 | globalObject().setProperty(name, value); |
| 616 | 620 | } else { |
| 617 | 621 | globalObject().setProperty(name, QScriptValue()); |