ConfigFile's parse/load methods and str_to_var can deserialize objects, and their _init methods execute immediately. This is something I've seen discussed online, but it's not well documented.
Checking that the text does not contain "Object(" before parsing is an easy way to prevent this and avoid malicious code.
I decided that I don't believe a check like this should be necessary and opened godotengine/godot#80562 instead.
If that issue is closed as not planned I'll reopen.
ConfigFile
'sparse
/load
methods andstr_to_var
can deserialize objects, and their_init
methods execute immediately. This is something I've seen discussed online, but it's not well documented. Checking that the text does not contain "Object(" before parsing is an easy way to prevent this and avoid malicious code.