Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 1 file). Show all
Unified · Split
| @@ -898,6 +898,9 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac · 897 unmodified lines | ||
| 898 | 898 | return sensitivity; |
| 899 | 899 | }; |
| 900 | 900 | |
| 901 | + // Guard against meaningless query and fragment parts. | |
| 902 | + // Do NOT use PreferLocalFile as its behavior is unpredictable (e.g., on defaultScriptsLocation()) | |
| 903 | + const auto strippingFlags = QUrl::RemoveFilename | QUrl::RemoveQuery | QUrl::RemoveFragment; | |
| 901 | 904 | for (QString file : includeFiles) { |
| 902 | 905 | QUrl thisURL { resolvePath(file) }; |
| 903 | 906 | if (!_includedURLs.contains(thisURL)) { |
| @@ -905,13 +908,13 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac · 1 unmodified line | ||
| 905 | 908 | ( |
| 906 | 909 | (currentSandboxURL.scheme() != "file") || |
| 907 | 910 | ( |
| 908 | − !thisURL.toString(QUrl::RemoveFilename).startsWith(defaultScriptsLocation().toString(), getSensitivity()) && | |
| 909 | − !thisURL.toString(QUrl::RemoveFilename).startsWith(currentSandboxURL.toString(QUrl::RemoveFilename), getSensitivity()) | |
| 911 | + !thisURL.toString(strippingFlags).startsWith(defaultScriptsLocation().toString(), getSensitivity()) && | |
| 912 | + !thisURL.toString(strippingFlags).startsWith(currentSandboxURL.toString(strippingFlags), getSensitivity()) | |
| 910 | 913 | ) |
| 911 | 914 | ) |
| 912 | 915 | ) { |
| 913 | 916 | qCWarning(scriptengine) << "Script.include() ignoring file path" << thisURL << "outside of original entity script" << currentSandboxURL; |
| 914 | − } else { | |
| 917 | + } else { | |
| 915 | 918 | // We could also check here for CORS, but we don't yet. |
| 916 | 919 | // It turns out that QUrl.resolve will not change hosts and copy authority, so we don't need to check that here. |
| 917 | 920 | urls.append(thisURL); |