Skip to content

Commit

Permalink
Disable enforcePrivacy in packaged projects
Browse files Browse the repository at this point in the history
The threat model of enforcePrivacy is so that people can open up sb3 files
in the editor and not worry about their webcam being streamed to an
attacker if the project doesn't use any unsandboxed custom extensions.

That threat model doesn't really make sense in the packager when we're
generating HTML files.
  • Loading branch information
GarboMuffin committed Oct 15, 2024
1 parent a9769bf commit 22470fc
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions src/packager/packager.js
Original file line number Diff line number Diff line change
Expand Up @@ -1585,6 +1585,9 @@ cd "$(dirname "$0")"
});
if (vm.renderer.setMaxTextureDimension) vm.renderer.setMaxTextureDimension(${this.options.maxTextureDimension});
// enforcePrivacy threat model only makes sense in the editor
if (vm.runtime.setEnforcePrivacy) vm.runtime.setEnforcePrivacy(false);
if (typeof ScaffoldingAddons !== 'undefined') {
ScaffoldingAddons.run(scaffolding, ${JSON.stringify(this.getAddonOptions())});
}
Expand Down

0 comments on commit 22470fc

Please sign in to comment.