search

CesiumGS / obj2gltf

Convert OBJ assets to glTF
Apache License 2.0
1.71k stars 307 forks source link

Secure by default #220

Open lilleyse opened 4 years ago

lilleyse commented 4 years ago

We should consider options.secure being enabled by default. This means that obj2gltf will not attempt to load files that are outside the obj's directory.

From @OmarShehata in https://github.com/AnalyticalGraphicsInc/obj2gltf/pull/219

This works well. My only comment here is I think we should consider setting --secure to be true by default. In general, we should always create tools that are secure by default.

I don't think that should be a big issue for users of this library, since I imagine OBJs with relative absolute paths aren't common, and getting the old behavior would just be a matter of setting --secure false.