godotengine / godotengine/godot-cpp

extension_api.json is not sanitized

Open
#1,536 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C++
Stars
2.7k
Forks
809
Avg merge
1d 3h
Merged PRs (30d)
8

Description

### Godot version

4.2.2

### godot-cpp version

4.2.2

### System information

Ubuntu 22.04.4 LTS 64-bit

### Issue description

When using a custom api file via **extension_api.json**, the field arguments/name for each method is used directly. I have a custom module, and I happened to use spaces, parenthesis, and brackets to describe the inputs of my functions. i.e.

```c++
ClassDB::bind_method(D_METHOD("example_function", "input (1)"), &Foo::example_function);
```

This does not create issues when compiling Godot. However, when compiling godot_cpp, it creates malformed function definitions:

```c++
void example_function(int input (1));
```

While this a fixable issue for me, there is a (very circumstantial) way to use this for code injection if the module came from a second party.

### Steps to reproduce

Compile godot with modules with malformed input descriptions. Create and move the custom.api. Compile the GDExtension Project.

### Minimal reproduction project

N/A

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.