Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 1 file). Show all
Unified · Split
| @@ -898,6 +898,9 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac · 897 unmodified lines | |||
| 898 | return sensitivity; | 898 | return sensitivity; |
| 899 | }; | 899 | }; |
| 900 | 900 | ||
| 901 | // Guard against meaningless query and fragment parts. | ||
| 902 | // Do NOT use PreferLocalFile as its behavior is unpredictable (e.g., on defaultScriptsLocation()) | ||
| 903 | const auto strippingFlags = QUrl::RemoveFilename | QUrl::RemoveQuery | QUrl::RemoveFragment; | ||
| 901 | for (QString file : includeFiles) { | 904 | for (QString file : includeFiles) { |
| 902 | QUrl thisURL { resolvePath(file) }; | 905 | QUrl thisURL { resolvePath(file) }; |
| 903 | if (!_includedURLs.contains(thisURL)) { | 906 | if (!_includedURLs.contains(thisURL)) { |
| @@ -905,13 +908,13 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac · 1 unmodified line | |||
| 905 | ( | 908 | ( |
| 906 | (currentSandboxURL.scheme() != "file") || | 909 | (currentSandboxURL.scheme() != "file") || |
| 907 | ( | 910 | ( |
| 908 | !thisURL.toString(QUrl::RemoveFilename).startsWith(defaultScriptsLocation().toString(), getSensitivity()) && | 911 | !thisURL.toString(strippingFlags).startsWith(defaultScriptsLocation().toString(), getSensitivity()) && |
| 909 | !thisURL.toString(QUrl::RemoveFilename).startsWith(currentSandboxURL.toString(QUrl::RemoveFilename), getSensitivity()) | 912 | !thisURL.toString(strippingFlags).startsWith(currentSandboxURL.toString(strippingFlags), getSensitivity()) |
| 910 | ) | 913 | ) |
| 911 | ) | 914 | ) |
| 912 | ) { | 915 | ) { |
| 913 | qCWarning(scriptengine) << "Script.include() ignoring file path" << thisURL << "outside of original entity script" << currentSandboxURL; | 916 | qCWarning(scriptengine) << "Script.include() ignoring file path" << thisURL << "outside of original entity script" << currentSandboxURL; |
| 914 | } else { | 917 | } else { |
| 915 | // We could also check here for CORS, but we don't yet. | 918 | // We could also check here for CORS, but we don't yet. |
| 916 | // It turns out that QUrl.resolve will not change hosts and copy authority, so we don't need to check that here. | 919 | // It turns out that QUrl.resolve will not change hosts and copy authority, so we don't need to check that here. |
| 917 | urls.append(thisURL); | 920 | urls.append(thisURL); |