Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 1 file). Show all
Unified · Split
| @@ -969,7 +969,7 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac · 968 unmodified lines | ||
| 969 | 969 | } |
| 970 | 970 | QList<QUrl> urls; |
| 971 | 971 | bool knowsSensitivity = false; |
| 972 | − Qt::CaseSensitivity sensitivity; | |
| 972 | + Qt::CaseSensitivity sensitivity { Qt::CaseSensitive }; | |
| 973 | 973 | auto getSensitivity = [&]() { |
| 974 | 974 | if (!knowsSensitivity) { |
| 975 | 975 | QString path = currentSandboxURL.path(); |
| @@ -986,6 +986,7 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac · 10 unmodified lines | ||
| 986 | 986 | const auto strippingFlags = QUrl::RemoveFilename | QUrl::RemoveQuery | QUrl::RemoveFragment; |
| 987 | 987 | for (QString file : includeFiles) { |
| 988 | 988 | QUrl thisURL; |
| 989 | + bool isStandardLibrary = false; | |
| 989 | 990 | if (file.startsWith("/~/")) { |
| 990 | 991 | thisURL = expandScriptUrl(QUrl::fromLocalFile(expandScriptPath(file))); |
| 991 | 992 | QUrl defaultScriptsLoc = defaultScriptsLocation(); |
| @@ -993,21 +994,17 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac · 1 unmodified line | ||
| 993 | 994 | qDebug() << "ScriptEngine::include -- skipping" << file << "-- outside of standard libraries"; |
| 994 | 995 | continue; |
| 995 | 996 | } |
| 997 | + isStandardLibrary = true; | |
| 996 | 998 | } else { |
| 997 | 999 | thisURL = resolvePath(file); |
| 998 | 1000 | } |
| 999 | 1001 | |
| 1000 | 1002 | if (!_includedURLs.contains(thisURL)) { |
| 1001 | − if (!currentSandboxURL.isEmpty() && (thisURL.scheme() == "file") && | |
| 1002 | − ( | |
| 1003 | − (currentSandboxURL.scheme() != "file") || | |
| 1004 | − ( | |
| 1005 | − !thisURL.toString(strippingFlags).startsWith(defaultScriptsLocation().toString(), getSensitivity()) && | |
| 1006 | − !thisURL.toString(strippingFlags).startsWith(currentSandboxURL.toString(strippingFlags), getSensitivity()) | |
| 1007 | − ) | |
| 1008 | − ) | |
| 1009 | − ) { | |
| 1010 | − qCWarning(scriptengine) << "Script.include() ignoring file path" << thisURL << "outside of original entity script" << currentSandboxURL; | |
| 1003 | + if (!isStandardLibrary && !currentSandboxURL.isEmpty() && (thisURL.scheme() == "file") && | |
| 1004 | + (currentSandboxURL.scheme() != "file" || | |
| 1005 | + !thisURL.toString(strippingFlags).startsWith(currentSandboxURL.toString(strippingFlags), getSensitivity()))) { | |
| 1006 | + qCWarning(scriptengine) << "Script.include() ignoring file path" | |
| 1007 | + << thisURL << "outside of original entity script" << currentSandboxURL; | |
| 1011 | 1008 | } else { |
| 1012 | 1009 | // We could also check here for CORS, but we don't yet. |
| 1013 | 1010 | // It turns out that QUrl.resolve will not change hosts and copy authority, so we don't need to check that here. |