Apply URL validation to top level window QML

Brad Davis committed 7 years ago

Commit e3393a81 parent 8bcde841 file · +11 −1Browse files

Showing the changes to interface/src/scripting/DesktopScriptingInterface.cpp (1 of 1 file). Show all

Unified · Split

interface/src/scripting/DesktopScriptingInterface.cpp+11−1

@@ -117,5 +117,15 @@ InteractiveWindowPointer DesktopScriptingInterface::createWindow(const QString& · 116 unmodified lines
117	117	Q_ARG(QVariantMap, properties));
118	118	return interactiveWindow;
119	119	}
120		− return new InteractiveWindow(sourceUrl, properties);;
	120	+
	121	+
	122	+ // The offscreen surface already validates against non-local QML sources, but we also need to ensure that
	123	+ // if we create top level QML, like dock widgets or other types of QQuickView containing desktop windows
	124	+ // that the source URL is permitted
	125	+ const auto& urlValidator = OffscreenQmlSurface::getUrlValidator();
	126	+ if (!urlValidator(sourceUrl)) {
	127	+ return nullptr;
	128	+ }
	129	+
	130	+ return new InteractiveWindow(sourceUrl, properties);
121	131	}