Protecting against script injection

[ExBemined]

For our simulator we are trying to achieve that in the final version users can create their own objects. These will be saved as .node file in the save directory to be loaded into a NodeReference. Our own content is protected by packing it into .ung files and as for scripts we only release the cache files so this is protected. However, the custom .node files are plain xml, and in theory someone who knows UnigineScript would be able to add a WorldExpression into this xml file that could use engine.world.call to invoke internal code. Since function names in the cache files are human readable, someone could then simply search for interesting function names related to licenses and try to call them.

 

Of course we could just call every function related to license something else to make it harder, but an option to disable the script compiler in the final release build would be better. Is there some way to achieve this? Or would that make WorldExpression nodes that are part of NodeReferences that are inside the .ung files also not work? I'm not sure if WorldExpressions within .ung files use caching in some way or are just encrypted source code that still needs to be compiled after decrypting.

[unclebob]

Hi Michiel,

 

I think the best idea is just to delete all WorldExpression nodes from user object during loading.