allow scripts on the web to refer to local libraries with /~/
Showing the changes to libraries/script-engine/src/ScriptEngines.cpp (1 of 4 files). Show all
Unified · Split
| @@ -70,6 +70,12 @@ QUrl normalizeScriptURL(const QUrl& rawScriptURL) { · 69 unmodified lines | |||
| 70 | } | 70 | } |
| 71 | } | 71 | } |
| 72 | 72 | ||
| 73 | QString expandScriptPath(const QString& rawPath) { | ||
| 74 | QStringList splitPath = rawPath.split("/"); | ||
| 75 | QUrl defaultScriptsLoc = defaultScriptsLocation(); | ||
| 76 | return defaultScriptsLoc.path() + "/" + splitPath.mid(2).join("/"); // 2 to skip the slashes in /~/ | ||
| 77 | } | ||
| 78 | |||
| 73 | QUrl expandScriptUrl(const QUrl& rawScriptURL) { | 79 | QUrl expandScriptUrl(const QUrl& rawScriptURL) { |
| 74 | QUrl normalizedScriptURL = normalizeScriptURL(rawScriptURL); | 80 | QUrl normalizedScriptURL = normalizeScriptURL(rawScriptURL); |
| 75 | if (normalizedScriptURL.scheme() == "http" || | 81 | if (normalizedScriptURL.scheme() == "http" || |
| @@ -79,9 +85,23 @@ QUrl expandScriptUrl(const QUrl& rawScriptURL) { · 3 unmodified lines | |||
| 79 | } else if (normalizedScriptURL.scheme() == "file") { | 85 | } else if (normalizedScriptURL.scheme() == "file") { |
| 80 | if (normalizedScriptURL.path().startsWith("/~/")) { | 86 | if (normalizedScriptURL.path().startsWith("/~/")) { |
| 81 | QUrl url = normalizedScriptURL; | 87 | QUrl url = normalizedScriptURL; |
| 82 | QStringList splitPath = url.path().split("/"); | 88 | url.setPath(expandScriptPath(url.path())); |
| 89 | |||
| 90 | // stop something like Script.include(["/~/../Desktop/naughty.js"]); from working | ||
| 91 | QFileInfo fileInfo(url.toLocalFile()); | ||
| 92 | url = QUrl::fromLocalFile(fileInfo.canonicalFilePath()); | ||
| 93 | |||
| 83 | QUrl defaultScriptsLoc = defaultScriptsLocation(); | 94 | QUrl defaultScriptsLoc = defaultScriptsLocation(); |
| 84 | url.setPath(defaultScriptsLoc.path() + "/" + splitPath.mid(2).join("/")); // 2 to skip the slashes in /~/ | 95 | if (!defaultScriptsLoc.isParentOf(url)) { |
| 96 | qCWarning(scriptengine) << "Script.include() ignoring file path" << rawScriptURL | ||
| 97 | << "-- outside of standard libraries: " | ||
| 98 | << url.path() | ||
| 99 | << defaultScriptsLoc.path(); | ||
| 100 | return rawScriptURL; | ||
| 101 | } | ||
| 102 | if (rawScriptURL.path().endsWith("/") && !url.path().endsWith("/")) { | ||
| 103 | url.setPath(url.path() + "/"); | ||
| 104 | } | ||
| 85 | return url; | 105 | return url; |
| 86 | } | 106 | } |
| 87 | return normalizedScriptURL; | 107 | return normalizedScriptURL; |