LWJGL / lwjgl3

LWJGL is a Java library that enables cross-platform access to popular native APIs useful in the development of graphics (OpenGL, Vulkan, bgfx), audio (OpenAL, Opus), parallel computing (OpenCL, CUDA) and XR (OpenVR, LibOVR, OpenXR) applications.
https://www.lwjgl.org
BSD 3-Clause "New" or "Revised" License
4.75k stars 635 forks source link

Include same warning comments from TFD in bindings class #951

Open ThatGravyBoat opened 9 months ago

ThatGravyBoat commented 9 months ago

Description

TinyFileDialog added a warning at the top of their files saying to not use user input (https://github.com/LWJGL/lwjgl3/blob/master/modules/lwjgl/tinyfd/src/main/c/tinyfiledialogs.c#L50). This is because it could and has been a pathway for vulnerabilities as previous versions of TFD had command injection vulnerabilities (CVE-2020-36767 and CVE-2023-47104).

It would be good to include this warning into the bindings aswell and possibly change the wording as to change it from "Do not use user inputs" to something along the lines of "Do not use untrusted inputs" as its more suitable.

A similar warning was also added to other bindings for TFD such as rust here https://github.com/jdm/tinyfiledialogs-rs/issues/40