Provide a way to load resources without running scripts
### Describe the project you are working on I'm the core developer of [EgoVenture](https://egoventure.deep-entertainment.de/), a first person adventure game framework and a contributor to [Escoria](https://github.com/godot-escoria), a third person adventure game framework. Both projects are using Resources to provide a savegame functionality. ### Describe the problem or limitation you are having in your project As recommended in the [official Godot docs](https://docs.godotengine.org/en/stable/tutorials/scripting/resources.html#creating-your-own-resources), Resources should be used to store and retrieved structured data. This can be used e.g. to persist the current game's state (aka savegame). As many godot developers ([GDquest, among others](https://twitter.com/NathanGDQuest/status/1549641252467089408?s=20&t=NxIUyG6D-ARFW_PG3i25aQ)) has pointed out: Using resources to store data can be dangerous as resources can also hold scripts which are executed when loading the resource later. That way, malicious people can send seemingly valid savegames and embed malicious code. ### Describe the feature / enhancement and how it helps to overcome the problem or limitation As it can be required to load scripts from Resources, Godot should feature a `SecureResourceLoader`, which specifically skips loading/executing scripts from resources so developers can still rely on resources as the most optimised method for storing structured data. ### Describe how your proposal will work, with
Posted by dploeger on Jul 20, 2022, 9:45 AM
Tags
Related issues
- [Meta] Feedback on granular control over Copilot changes
- unexpected status 401 Unauthorized issue
- [MODEL] Measurable quality regression in Claude generation 5 (Fable 5 / Opus 5 / Sonnet 5): worse nonsense detection, ~2x verbosity, under-disclosed model fallb
- [CRITICAL] Subagent spawning and subagent pattern bugs trigger infinite recursion, infinite token usage, grossly inefficient token usage, and lost accumulated s
- Video stops playing after some minutes
- [MODEL] Claude verbose code comments by default — ignores instructions to stop.
Raise real-world problems, find people facing the same issue, and discuss solutions.2,500 issues0 comments
github (Software)
[Meta] Feedback on granular control over Copilot changes
unexpected status 401 Unauthorized issue
[MODEL] Measurable quality regression in Claude generation 5 (Fable 5 / Opus 5 / Sonnet 5): worse nonsense detection, ~2x verbosity, under-disclosed model fallb
[CRITICAL] Subagent spawning and subagent pattern bugs trigger infinite recursion, infinite token usage, grossly inefficient token usage, and lost accumulated s
Video stops playing after some minutes
[MODEL] Claude verbose code comments by default — ignores instructions to stop.
Scope Codex VS Code chats to the current workspace/project
Update on "Co-authored-by: Copilot" in commit messages
Provide a way to load resources without running scripts
### Describe the project you are working on I'm the core developer of [EgoVenture](https://egoventure.deep-entertainment.de/), a first person adventure game framework and a contributor to [Escoria](https://github.com/godot-escoria), a third person adventure game framework. Both projects are using Resources to provide a savegame functionality. ### Describe the problem or limitation you are having in your project As recommended in the [official Godot docs](https://docs.godotengine.org/en/stable/tutorials/scripting/resources.html#creating-your-own-resources), Resources should be used to store and retrieved structured data. This can be used e.g. to persist the current game's state (aka savegame). As many godot developers ([GDquest, among others](https://twitter.com/NathanGDQuest/status/1549641252467089408?s=20&t=NxIUyG6D-ARFW_PG3i25aQ)) has pointed out: Using resources to store data can be dangerous as resources can also hold scripts which are executed when loading the resource later. That way, malicious people can send seemingly valid savegames and embed malicious code. ### Describe the feature / enhancement and how it helps to overcome the problem or limitation As it can be required to load scripts from Resources, Godot should feature a `SecureResourceLoader`, which specifically skips loading/executing scripts from resources so developers can still rely on resources as the most optimised method for storing structured data. ### Describe how your proposal will work, with
Comments (0)
No comments yet. Start the discussion.