MerlinVR / USharpVideo

A basic video player made for VRChat using Udon and UdonSharp
MIT License
317 stars 40 forks source link

Support underscored versions of video player callback methods #35

Closed NGenesis closed 2 years ago

NGenesis commented 2 years ago

Registering a callback handler for video player events (e.g. OnUSharpVideoPlay) currently requires that the receiver methods are set up in a way that remote malicious clients can call SendCustomNetworkEvent on them. For additional security it would be great if underscored versions of the callbacks (e.g. _OnUSharpVideoPlay) could be supported.

MerlinVR commented 2 years ago

USharpVideo could mangle those events but it wouldn't provide much benefit since the video player itself doesn't mangle its public API so if someone wants to abuse the video player they'd just abuse the actual video player instead of whatever is hooked for callbacks. You may want to consider using a different video player if you're looking for having the API mangled to prevent the rare case of someone spamming network events on things they shouldn't.