Prohibit entity script file includes from outside the original entity script's directory (unless its in our resources).

howard-stearns committed 10 years ago

Commit 7b7ec5a1 parent 278fe932 files · +56 −21Browse files

Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 2 files). Show all

Unified · Split

libraries/script-engine/src/ScriptEngine.cpp+51−19

         _registeredHandlers[entityID] = RegisteredEventHandlers();
     }
     CallbackList& handlersForEvent = _registeredHandlers[entityID][eventName];
-    CallbackData handlerData = {handler, currentEntityIdentifier};
+    CallbackData handlerData = {handler, currentEntityIdentifier, currentSandboxURL};
     handlersForEvent << handlerData; // Note that the same handler can be added many times. See removeEntityEventHandler().
 }
     // call the associated JS function, if it exists
     if (timerData.function.isValid()) {
-        callWithEnvironment(timerData.definingEntityIdentifier, timerData.function, timerData.function, QScriptValueList());
+        callWithEnvironment(timerData.definingEntityIdentifier, timerData.definingSandboxURL, timerData.function, timerData.function, QScriptValueList());
     }
 }
     // make sure the timer stops when the script does
     connect(this, &ScriptEngine::scriptEnding, newTimer, &QTimer::stop);
-    CallbackData timerData = {function, currentEntityIdentifier};
+    CallbackData timerData = {function, currentEntityIdentifier, currentSandboxURL};
     _timerFunctionMap.insert(newTimer, timerData);
     newTimer->start(intervalMS);
         return; // bail early
     }
     QList<QUrl> urls;
+    bool knowsSensitivity = false;
+    Qt::CaseSensitivity sensitivity;
+    auto getSensitivity = [&]() {
+        if (!knowsSensitivity) {
+            QString path = currentSandboxURL.path();
+            QFileInfo upperFI(path.toUpper());
+            QFileInfo lowerFI(path.toLower());
+            sensitivity = (upperFI == lowerFI) ? Qt::CaseInsensitive : Qt::CaseSensitive;
+            knowsSensitivity = true;
+        }
+        return sensitivity;
+    };
     for (QString file : includeFiles) {
         QUrl thisURL { resolvePath(file) };
         if (!_includedURLs.contains(thisURL)) {
-            urls.append(thisURL);
+            if (!currentSandboxURL.isEmpty() && (thisURL.scheme() == "file") &&
-            _includedURLs << thisURL;
+                (
-        }
+                    (currentSandboxURL.scheme() != "file") ||
-        else {
+                        (
+                            !thisURL.toString(QUrl::RemoveFilename).startsWith(defaultScriptsLocation().toString(), getSensitivity()) &&
+                            !thisURL.toString(QUrl::RemoveFilename).startsWith(currentSandboxURL.toString(QUrl::RemoveFilename), getSensitivity())
+                        )
+                 )
+                ) {
+                qCWarning(scriptengine) << "Script.include() ignoring file path" << thisURL << "outside of original entity script" << currentSandboxURL;
+             } else {
+                // We could also check here for CORS, but we don't yet.
+                // It turns out that QUrl.resolve will not change hosts and copy authority, so we don't need to check that here.
+                urls.append(thisURL);
+                _includedURLs << thisURL;
+            }
+        } else {
             qCDebug(scriptengine) << "Script.include() ignoring previously included url:" << thisURL;
         }
     }
     BatchLoader* loader = new BatchLoader(urls);
     EntityItemID capturedEntityIdentifier = currentEntityIdentifier;
+    QUrl capturedSandboxURL = currentSandboxURL;
     auto evaluateScripts = [=](const QMap<QUrl, QString>& data) {
         auto parentURL = _parentURL;
                 auto operation = [&]() {
                     evaluate(contents, url.toString());
                 };
-                doWithEnvironment(capturedEntityIdentifier, operation);
+                doWithEnvironment(capturedEntityIdentifier, capturedSandboxURL, operation);
             }
         }
         _parentURL = parentURL;
         if (callback.isFunction()) {
-            callWithEnvironment(capturedEntityIdentifier, QScriptValue(callback), QScriptValue(), QScriptValueList());
+            callWithEnvironment(capturedEntityIdentifier, capturedSandboxURL, QScriptValue(callback), QScriptValue(), QScriptValueList());
         }
         loader->deleteLater();
     CallbackList handlersForEvent = handlersOnEntity[eventName];
     if (!handlersForEvent.isEmpty()) {
         for (int i = 0; i < handlersForEvent.count(); ++i) {
-            // handlersForEvent[i] can tonain many handlers that may have each been added by different interface or entity scripts,
+            // handlersForEvent[i] can contain many handlers that may have each been added by different interface or entity scripts,
             // and the entity scripts may be for entities other than the one this is a handler for.
             // Fortunately, the definingEntityIdentifier captured the entity script id (if any) when the handler was added.
-            callWithEnvironment(handlersForEvent[i].definingEntityIdentifier, handlersForEvent[i].function, QScriptValue(), eventHandlerArgs);
+            CallbackData& handler = handlersForEvent[i];
+            callWithEnvironment(handler.definingEntityIdentifier, handler.definingSandboxURL, handler.function, QScriptValue(), eventHandlerArgs);
         }
     }
 }
         lastModified = (quint64)QFileInfo(file).lastModified().toMSecsSinceEpoch();
     }
     QScriptValue entityScriptConstructor, entityScriptObject;
+    QUrl sandboxURL = currentSandboxURL.isEmpty() ? scriptOrURL : currentSandboxURL;
     auto initialization = [&]{
         entityScriptConstructor = evaluate(contents, fileName);
         entityScriptObject = entityScriptConstructor.construct();
     };
-    doWithEnvironment(entityID, initialization);
+    doWithEnvironment(entityID, sandboxURL, initialization);
-    EntityScriptDetails newDetails = { scriptOrURL, entityScriptObject, lastModified };
+    EntityScriptDetails newDetails = { scriptOrURL, entityScriptObject, lastModified, sandboxURL };
     _entityScripts[entityID] = newDetails;
     if (isURL) {
         setParentURL("");
 // Even if entityID is supplied as currentEntityIdentifier, this still documents the source
 // of the code being executed (e.g., if we ever sandbox different entity scripts, or provide different
 // global values for different entity scripts).
-void ScriptEngine::doWithEnvironment(const EntityItemID& entityID, std::function<void()> operation) {
+void ScriptEngine::doWithEnvironment(const EntityItemID& entityID, const QUrl& sandboxURL, std::function<void()> operation) {
     EntityItemID oldIdentifier = currentEntityIdentifier;
+    QUrl oldSandboxURL = currentSandboxURL;
     currentEntityIdentifier = entityID;
+    currentSandboxURL = sandboxURL;
 #if DEBUG_CURRENT_ENTITY
     QScriptValue oldData = this->globalObject().property("debugEntityID");
 #endif
     currentEntityIdentifier = oldIdentifier;
+    currentSandboxURL = oldSandboxURL;
 }
-void ScriptEngine::callWithEnvironment(const EntityItemID& entityID, QScriptValue function, QScriptValue thisObject, QScriptValueList args) {
+void ScriptEngine::callWithEnvironment(const EntityItemID& entityID, const QUrl& sandboxURL, QScriptValue function, QScriptValue thisObject, QScriptValueList args) {
     auto operation = [&]() {
         function.call(thisObject, args);
     };
-    doWithEnvironment(entityID, operation);
+    doWithEnvironment(entityID, sandboxURL, operation);
 }
 void ScriptEngine::callEntityScriptMethod(const EntityItemID& entityID, const QString& methodName, const QStringList& params) {
             QScriptValueList args;
             args << entityID.toScriptValue(this);
             args << qScriptValueFromSequence(this, params);
-            callWithEnvironment(entityID, entityScript.property(methodName), entityScript, args);
+            callWithEnvironment(entityID, details.definingSandboxURL, entityScript.property(methodName), entityScript, args);
         }
     }
             QScriptValueList args;
             args << entityID.toScriptValue(this);
             args << event.toScriptValue(this);
-            callWithEnvironment(entityID, entityScript.property(methodName), entityScript, args);
+            callWithEnvironment(entityID, details.definingSandboxURL, entityScript.property(methodName), entityScript, args);
         }
     }
 }
             args << entityID.toScriptValue(this);
             args << otherID.toScriptValue(this);
             args << collisionToScriptValue(this, collision);
-            callWithEnvironment(entityID, entityScript.property(methodName), entityScript, args);
+            callWithEnvironment(entityID, details.definingSandboxURL, entityScript.property(methodName), entityScript, args);
         }
     }
 }