search

godotengine / godot-demo-projects

Demonstration and Template Projects
https://godotengine.org
MIT License
5.65k stars 1.58k forks source link

Add checks to the saving and loading demo to prevent deserializing Objects #939

Closed jtnicholl closed 1 year ago

jtnicholl commented 1 year ago

ConfigFile's parse/load methods and str_to_var can deserialize objects, and their _init methods execute immediately. This is something I've seen discussed online, but it's not well documented. Checking that the text does not contain "Object(" before parsing is an easy way to prevent this and avoid malicious code.

jtnicholl commented 1 year ago

I decided that I don't believe a check like this should be necessary and opened godotengine/godot#80562 instead. If that issue is closed as not planned I'll reopen.