Mirrors/overte
3
0
Fork 0
mirror of https://github.com/overte-org/overte.git synced 2025-04-25 12:33:27 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Guard against meaningless query and fragment parts.

Browse source
This commit is contained in:
howard-stearns 2016-04-06 15:21:43 -07:00
parent 1de3aaffc7
commit f35c59ce5f
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
libraries/script-engine/src/ScriptEngine.cpp
View file

@ -898,6 +898,9 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac
return sensitivity; return sensitivity;
}; };
// Guard against meaningless query and fragment parts.
// Do NOT use PreferLocalFile as its behavior is unpredictable (e.g., on defaultScriptsLocation())
const auto strippingFlags = QUrl::RemoveFilename | QUrl::RemoveQuery | QUrl::RemoveFragment;
for (QString file : includeFiles) { for (QString file : includeFiles) {
QUrl thisURL { resolvePath(file) }; QUrl thisURL { resolvePath(file) };
if (!_includedURLs.contains(thisURL)) { if (!_includedURLs.contains(thisURL)) {
@ -905,13 +908,13 @@ void ScriptEngine::include(const QStringList& includeFiles, QScriptValue callbac
( (
(currentSandboxURL.scheme() != "file") || (currentSandboxURL.scheme() != "file") ||
( (
!thisURL.toString(QUrl::RemoveFilename).startsWith(defaultScriptsLocation().toString(), getSensitivity()) && !thisURL.toString(strippingFlags).startsWith(defaultScriptsLocation().toString(), getSensitivity()) &&
!thisURL.toString(QUrl::RemoveFilename).startsWith(currentSandboxURL.toString(QUrl::RemoveFilename), getSensitivity()) !thisURL.toString(strippingFlags).startsWith(currentSandboxURL.toString(strippingFlags), getSensitivity())
) )
) )
) { ) {
qCWarning(scriptengine) << "Script.include() ignoring file path" << thisURL << "outside of original entity script" << currentSandboxURL; qCWarning(scriptengine) << "Script.include() ignoring file path" << thisURL << "outside of original entity script" << currentSandboxURL;
} else { } else {
// We could also check here for CORS, but we don't yet. // We could also check here for CORS, but we don't yet.
// It turns out that QUrl.resolve will not change hosts and copy authority, so we don't need to check that here. // It turns out that QUrl.resolve will not change hosts and copy authority, so we don't need to check that here.
urls.append(thisURL); urls.append(thisURL);