godotengine / godot-proposals

Godot Improvement Proposals (GIPs)
MIT License
1.11k stars 69 forks source link

Audit and mitigate GLTF2 security issues #3757

Open fire opened 2 years ago

fire commented 2 years ago

Describe the project you are working on

3d game with multiplayer

Describe the problem or limitation you are having in your project

Want to load player artwork as gltf

Describe the feature / enhancement and how it helps to overcome the problem or limitation

Need to audit and improve gltf runtime loading security.

Describe how your proposal will work, with code, pseudo-code, mock-ups, and/or diagrams

Add explicit security checks and migrate any URI resolving code for textures & buffers & etc. into a common helper which has explicit "" check that returns ERR_FAIL.

Blend shape key frames should have processing limits requested in Gltf export blend shape godot#48947.

If this enhancement will not be used often, can it be worked around with a few lines of script?

Not related to code length but toward correctness.

Is there a reason why this should be core and not an add-on in the asset library?

The audit is about code that already exists.

fire commented 2 years ago

Tracker: