History

whitelist -> allowlist

HifiExperiments committed 2 years ago

Commit f2d8fa21 parent 2876a4d28 files · +199 −199Browse files

Showing the changes to libraries/script-engine/src/ScriptManager.cpp (1 of 28 files). Show all

Unified · Split

libraries/script-engine/src/ScriptManager.cpp+34−34
@@ -2192,17 +2192,17 @@ void ScriptManager::entityScriptContentAvailable(const EntityItemID& entityID, c · 2191 unmodified lines
2192 exception = testConstructor;2192 exception = testConstructor;
2193 }2193 }
2194 } else {2194 } else {
2195 // ENTITY SCRIPT WHITELIST STARTS HERE2195 // ENTITY SCRIPT ALLOWLIST STARTS HERE
2196 auto nodeList = DependencyManager::get<NodeList>();2196 auto nodeList = DependencyManager::get<NodeList>();
2197 bool passList = false; // assume unsafe2197 bool passList = false; // assume unsafe
2198 QString whitelistPrefix = "[WHITELIST ENTITY SCRIPTS]";2198 QString allowlistPrefix = "[ALLOWLIST ENTITY SCRIPTS]";
2199 QList<QString> safeURLPrefixes = { "file:///", "atp:", "cache:" };2199 QList<QString> safeURLPrefixes = { "file:///", "atp:", "cache:" };
2200 safeURLPrefixes += qEnvironmentVariable("EXTRA_WHITELIST").trimmed().split(QRegExp("\\s*,\\s*"), Qt::SkipEmptyParts);2200 safeURLPrefixes += qEnvironmentVariable("EXTRA_ALLOWLIST").trimmed().split(QRegExp("\\s*,\\s*"), Qt::SkipEmptyParts);
2201 2201
2202 // Entity Script Whitelist toggle check.2202 // Entity Script Allowlist toggle check.
2203 Setting::Handle<bool> whitelistEnabled {"private/whitelistEnabled", false };2203 Setting::Handle<bool> allowlistEnabled {"private/allowlistEnabled", false };
2204 2204
2205 if (!whitelistEnabled.get()) {2205 if (!allowlistEnabled.get()) {
2206 passList = true;2206 passList = true;
2207 }2207 }
2208 2208
@@ -2212,39 +2212,39 @@ void ScriptManager::entityScriptContentAvailable(const EntityItemID& entityID, c · 3 unmodified lines
2212 safeURLPrefixes += settingsSafeURLS;2212 safeURLPrefixes += settingsSafeURLS;
2213 // END Pull SAFEURLS from the Interface.JSON settings.2213 // END Pull SAFEURLS from the Interface.JSON settings.
2214 2214
2215 // Get current domain whitelist bypass, in case an entire domain is whitelisted.2215 // Get current domain allowlist bypass, in case an entire domain is allowlisted.
2216 QString currentDomain = DependencyManager::get<AddressManager>()->getDomainURL().host();2216 QString currentDomain = DependencyManager::get<AddressManager>()->getDomainURL().host();
2217 2217
2218 QString domainSafeIP = nodeList->getDomainHandler().getHostname();2218 QString domainSafeIP = nodeList->getDomainHandler().getHostname();
2219 QString domainSafeURL = URL_SCHEME_OVERTE + "://" + currentDomain;2219 QString domainSafeURL = URL_SCHEME_OVERTE + "://" + currentDomain;
2220 for (const auto& str : safeURLPrefixes) {2220 for (const auto& str : safeURLPrefixes) {
2221 if (domainSafeURL.startsWith(str) || domainSafeIP.startsWith(str)) {2221 if (domainSafeURL.startsWith(str) || domainSafeIP.startsWith(str)) {
2222 qCDebug(scriptengine) << whitelistPrefix << "Whitelist Bypassed, entire domain is whitelisted. Current Domain Host: "2222 qCDebug(scriptengine) << allowlistPrefix << "Allowlist Bypassed, entire domain is allowlisted. Current Domain Host: "
2223 << nodeList->getDomainHandler().getHostname()2223 << nodeList->getDomainHandler().getHostname()
2224 << "Current Domain: " << currentDomain;2224 << "Current Domain: " << currentDomain;
2225 passList = true;2225 passList = true;
2226 }2226 }
2227 }2227 }
2228 // END bypass whitelist based on current domain.2228 // END bypass allowlist based on current domain.
2229 2229
2230 // Start processing scripts through the whitelist.2230 // Start processing scripts through the allowlist.
2231 if (ScriptManager::getContext() == "entity_server") { // If running on the server, do not engage whitelist.2231 if (ScriptManager::getContext() == "entity_server") { // If running on the server, do not engage allowlist.
2232 passList = true;2232 passList = true;
2233 } else if (!passList) { // If waved through, do not engage whitelist.2233 } else if (!passList) { // If waved through, do not engage allowlist.
2234 for (const auto& str : safeURLPrefixes) {2234 for (const auto& str : safeURLPrefixes) {
2235 qCDebug(scriptengine) << whitelistPrefix << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN"2235 qCDebug(scriptengine) << allowlistPrefix << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN"
2236 << scriptOrURL.startsWith(str);2236 << scriptOrURL.startsWith(str);
2237 if (!str.isEmpty() && scriptOrURL.startsWith(str)) {2237 if (!str.isEmpty() && scriptOrURL.startsWith(str)) {
2238 passList = true;2238 passList = true;
2239 qCDebug(scriptengine) << whitelistPrefix << "Script approved.";2239 qCDebug(scriptengine) << allowlistPrefix << "Script approved.";
2240 break; // Bail early since we found a match.2240 break; // Bail early since we found a match.
2241 }2241 }
2242 }2242 }
2243 }2243 }
2244 // END processing of scripts through the whitelist.2244 // END processing of scripts through the allowlist.
2245 2245
2246 if (!passList) { // If the entity failed to pass for any reason, it's blocked and an error is thrown.2246 if (!passList) { // If the entity failed to pass for any reason, it's blocked and an error is thrown.
2247 qCDebug(scriptengine) << whitelistPrefix << "(disabled entity script)" << entityID.toString() << scriptOrURL;2247 qCDebug(scriptengine) << allowlistPrefix << "(disabled entity script)" << entityID.toString() << scriptOrURL;
2248 exception = _engine->makeError(_engine->newValue("UNSAFE_ENTITY_SCRIPTS == 0"));2248 exception = _engine->makeError(_engine->newValue("UNSAFE_ENTITY_SCRIPTS == 0"));
2249 } else {2249 } else {
2250 QTimer timeout;2250 QTimer timeout;
@@ -2267,7 +2267,7 @@ void ScriptManager::entityScriptContentAvailable(const EntityItemID& entityID, c · 16 unmodified lines
2267 exception = testConstructor;2267 exception = testConstructor;
2268 }2268 }
2269 }2269 }
2270 // ENTITY SCRIPT WHITELIST ENDS HERE, uncomment below for original full disabling.2270 // ENTITY SCRIPT ALLOWLIST ENDS HERE, uncomment below for original full disabling.
2271 2271
2272 // qCDebug(scriptengine) << "(disabled entity script)" << entityID.toString() << scriptOrURL;2272 // qCDebug(scriptengine) << "(disabled entity script)" << entityID.toString() << scriptOrURL;
2273 // exception = makeError("UNSAFE_ENTITY_SCRIPTS == 0");2273 // exception = makeError("UNSAFE_ENTITY_SCRIPTS == 0");
@@ -2303,17 +2303,17 @@ void ScriptManager::entityScriptContentAvailable(const EntityItemID& entityID, c · 29 unmodified lines
2303 return; // done processing script2303 return; // done processing script
2304 }*/2304 }*/
2305 2305
2306 // ENTITY SCRIPT WHITELIST STARTS HERE2306 // ENTITY SCRIPT ALLOWLIST STARTS HERE
2307 auto nodeList = DependencyManager::get<NodeList>();2307 auto nodeList = DependencyManager::get<NodeList>();
2308 bool passList = false; // assume unsafe2308 bool passList = false; // assume unsafe
2309 QString whitelistPrefix = "[WHITELIST ENTITY SCRIPTS]";2309 QString allowlistPrefix = "[ALLOWLIST ENTITY SCRIPTS]";
2310 QList<QString> safeURLPrefixes = { "file:///", "atp:", "cache:" };2310 QList<QString> safeURLPrefixes = { "file:///", "atp:", "cache:" };
2311 safeURLPrefixes += qEnvironmentVariable("EXTRA_WHITELIST").trimmed().split(QRegExp("\\s*,\\s*"), Qt::SkipEmptyParts);2311 safeURLPrefixes += qEnvironmentVariable("EXTRA_ALLOWLIST").trimmed().split(QRegExp("\\s*,\\s*"), Qt::SkipEmptyParts);
2312 2312
2313 // Entity Script Whitelist toggle check.2313 // Entity Script Allowlist toggle check.
2314 Setting::Handle<bool> whitelistEnabled {"private/whitelistEnabled", false };2314 Setting::Handle<bool> allowlistEnabled {"private/allowlistEnabled", false };
2315 2315
2316 if (!whitelistEnabled.get()) {2316 if (!allowlistEnabled.get()) {
2317 passList = true;2317 passList = true;
2318 }2318 }
2319 2319
@@ -2323,40 +2323,40 @@ void ScriptManager::entityScriptContentAvailable(const EntityItemID& entityID, c · 3 unmodified lines
2323 safeURLPrefixes += settingsSafeURLS;2323 safeURLPrefixes += settingsSafeURLS;
2324 // END Pull SAFEURLS from the Interface.JSON settings.2324 // END Pull SAFEURLS from the Interface.JSON settings.
2325 2325
2326 // Get current domain whitelist bypass, in case an entire domain is whitelisted.2326 // Get current domain allowlist bypass, in case an entire domain is allowlisted.
2327 QString currentDomain = DependencyManager::get<AddressManager>()->getDomainURL().host();2327 QString currentDomain = DependencyManager::get<AddressManager>()->getDomainURL().host();
2328 2328
2329 QString domainSafeIP = nodeList->getDomainHandler().getHostname();2329 QString domainSafeIP = nodeList->getDomainHandler().getHostname();
2330 QString domainSafeURL = URL_SCHEME_OVERTE + "://" + currentDomain;2330 QString domainSafeURL = URL_SCHEME_OVERTE + "://" + currentDomain;
2331 for (const auto& str : safeURLPrefixes) {2331 for (const auto& str : safeURLPrefixes) {
2332 if (domainSafeURL.startsWith(str) || domainSafeIP.startsWith(str)) {2332 if (domainSafeURL.startsWith(str) || domainSafeIP.startsWith(str)) {
2333 qCDebug(scriptengine) << whitelistPrefix << "Whitelist Bypassed, entire domain is whitelisted. Current Domain Host: "2333 qCDebug(scriptengine) << allowlistPrefix << "Allowlist Bypassed, entire domain is allowlisted. Current Domain Host: "
2334 << nodeList->getDomainHandler().getHostname()2334 << nodeList->getDomainHandler().getHostname()
2335 << "Current Domain: " << currentDomain;2335 << "Current Domain: " << currentDomain;
2336 passList = true;2336 passList = true;
2337 }2337 }
2338 }2338 }
2339 // END bypass whitelist based on current domain.2339 // END bypass allowlist based on current domain.
2340 2340
2341 // Start processing scripts through the whitelist.2341 // Start processing scripts through the allowlist.
2342 if (ScriptManager::getContext() == "entity_server") { // If running on the server, do not engage whitelist.2342 if (ScriptManager::getContext() == "entity_server") { // If running on the server, do not engage allowlist.
2343 passList = true;2343 passList = true;
2344 } else if (!passList) { // If waved through, do not engage whitelist.2344 } else if (!passList) { // If waved through, do not engage allowlist.
2345 for (const auto& str : safeURLPrefixes) {2345 for (const auto& str : safeURLPrefixes) {
2346 qCDebug(scriptengine) << whitelistPrefix << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN"2346 qCDebug(scriptengine) << allowlistPrefix << "Script URL: " << scriptOrURL << "TESTING AGAINST" << str << "RESULTS IN"
2347 << scriptOrURL.startsWith(str);2347 << scriptOrURL.startsWith(str);
2348 if (!str.isEmpty() && scriptOrURL.startsWith(str)) {2348 if (!str.isEmpty() && scriptOrURL.startsWith(str)) {
2349 passList = true;2349 passList = true;
2350 qCDebug(scriptengine) << whitelistPrefix << "Script approved.";2350 qCDebug(scriptengine) << allowlistPrefix << "Script approved.";
2351 break; // Bail early since we found a match.2351 break; // Bail early since we found a match.
2352 }2352 }
2353 }2353 }
2354 }2354 }
2355 // END processing of scripts through the whitelist.2355 // END processing of scripts through the allowlist.
2356 2356
2357 ScriptValue exception;2357 ScriptValue exception;
2358 if (!passList) { // If the entity failed to pass for any reason, it's blocked and an error is thrown.2358 if (!passList) { // If the entity failed to pass for any reason, it's blocked and an error is thrown.
2359 qCDebug(scriptengine) << whitelistPrefix << "(disabled entity script)" << entityID.toString() << scriptOrURL;2359 qCDebug(scriptengine) << allowlistPrefix << "(disabled entity script)" << entityID.toString() << scriptOrURL;
2360 exception = _engine->makeError(_engine->newValue("UNSAFE_ENTITY_SCRIPTS == 0"));2360 exception = _engine->makeError(_engine->newValue("UNSAFE_ENTITY_SCRIPTS == 0"));
2361 }2361 }
2362 2362
@@ -2369,7 +2369,7 @@ void ScriptManager::entityScriptContentAvailable(const EntityItemID& entityID, c · 6 unmodified lines
2369 emit unhandledException(scriptRuntimeException);2369 emit unhandledException(scriptRuntimeException);
2370 return;2370 return;
2371 }2371 }
2372 // ENTITY SCRIPT WHITELIST ENDS HERE, uncomment below for original full disabling.2372 // ENTITY SCRIPT ALLOWLIST ENDS HERE, uncomment below for original full disabling.
2373 2373
2374 // qCDebug(scriptengine) << "(disabled entity script)" << entityID.toString() << scriptOrURL;2374 // qCDebug(scriptengine) << "(disabled entity script)" << entityID.toString() << scriptOrURL;
2375 // exception = makeError("UNSAFE_ENTITY_SCRIPTS == 0");2375 // exception = makeError("UNSAFE_ENTITY_SCRIPTS == 0");