Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 1 file). Show all
Unified · Split
| @@ -969,7 +969,7 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac · 968 unmodified lines | |||
| 969 | } | 969 | } |
| 970 | QList<QUrl> urls; | 970 | QList<QUrl> urls; |
| 971 | bool knowsSensitivity = false; | 971 | bool knowsSensitivity = false; |
| 972 | Qt::CaseSensitivity sensitivity; | 972 | Qt::CaseSensitivity sensitivity { Qt::CaseSensitive }; |
| 973 | auto getSensitivity = [&]() { | 973 | auto getSensitivity = [&]() { |
| 974 | if (!knowsSensitivity) { | 974 | if (!knowsSensitivity) { |
| 975 | QString path = currentSandboxURL.path(); | 975 | QString path = currentSandboxURL.path(); |
| @@ -986,6 +986,7 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac · 10 unmodified lines | |||
| 986 | const auto strippingFlags = QUrl::RemoveFilename | QUrl::RemoveQuery | QUrl::RemoveFragment; | 986 | const auto strippingFlags = QUrl::RemoveFilename | QUrl::RemoveQuery | QUrl::RemoveFragment; |
| 987 | for (QString file : includeFiles) { | 987 | for (QString file : includeFiles) { |
| 988 | QUrl thisURL; | 988 | QUrl thisURL; |
| 989 | bool isStandardLibrary = false; | ||
| 989 | if (file.startsWith("/~/")) { | 990 | if (file.startsWith("/~/")) { |
| 990 | thisURL = expandScriptUrl(QUrl::fromLocalFile(expandScriptPath(file))); | 991 | thisURL = expandScriptUrl(QUrl::fromLocalFile(expandScriptPath(file))); |
| 991 | QUrl defaultScriptsLoc = defaultScriptsLocation(); | 992 | QUrl defaultScriptsLoc = defaultScriptsLocation(); |
| @@ -993,21 +994,17 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac · 1 unmodified line | |||
| 993 | qDebug() << "ScriptEngine::include -- skipping" << file << "-- outside of standard libraries"; | 994 | qDebug() << "ScriptEngine::include -- skipping" << file << "-- outside of standard libraries"; |
| 994 | continue; | 995 | continue; |
| 995 | } | 996 | } |
| 997 | isStandardLibrary = true; | ||
| 996 | } else { | 998 | } else { |
| 997 | thisURL = resolvePath(file); | 999 | thisURL = resolvePath(file); |
| 998 | } | 1000 | } |
| 999 | 1001 | ||
| 1000 | if (!_includedURLs.contains(thisURL)) { | 1002 | if (!_includedURLs.contains(thisURL)) { |
| 1001 | if (!currentSandboxURL.isEmpty() && (thisURL.scheme() == "file") && | 1003 | if (!isStandardLibrary && !currentSandboxURL.isEmpty() && (thisURL.scheme() == "file") && |
| 1002 | ( | 1004 | (currentSandboxURL.scheme() != "file" || |
| 1003 | (currentSandboxURL.scheme() != "file") || | 1005 | !thisURL.toString(strippingFlags).startsWith(currentSandboxURL.toString(strippingFlags), getSensitivity()))) { |
| 1004 | ( | 1006 | qCWarning(scriptengine) << "Script.include() ignoring file path" |
| 1005 | !thisURL.toString(strippingFlags).startsWith(defaultScriptsLocation().toString(), getSensitivity()) && | 1007 | << thisURL << "outside of original entity script" << currentSandboxURL; |
| 1006 | !thisURL.toString(strippingFlags).startsWith(currentSandboxURL.toString(strippingFlags), getSensitivity()) | ||
| 1007 | ) | ||
| 1008 | ) | ||
| 1009 | ) { | ||
| 1010 | qCWarning(scriptengine) << "Script.include() ignoring file path" << thisURL << "outside of original entity script" << currentSandboxURL; | ||
| 1011 | } else { | 1008 | } else { |
| 1012 | // We could also check here for CORS, but we don't yet. | 1009 | // We could also check here for CORS, but we don't yet. |
| 1013 | // It turns out that QUrl.resolve will not change hosts and copy authority, so we don't need to check that here. | 1010 | // It turns out that QUrl.resolve will not change hosts and copy authority, so we don't need to check that here. |