godotengine / godotengine/godot-cpp
extension_api.json is not sanitized
- Dominant language
- C++
- Stars
- 2.7k
- Forks
- 809
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 8
Description
### Godot version
4.2.2
### godot-cpp version
4.2.2
### System information
Ubuntu 22.04.4 LTS 64-bit
### Issue description
When using a custom api file via **extension_api.json**, the field arguments/name for each method is used directly. I have a custom module, and I happened to use spaces, parenthesis, and brackets to describe the inputs of my functions. i.e.
```c++
ClassDB::bind_method(D_METHOD("example_function", "input (1)"), &Foo::example_function);
```
This does not create issues when compiling Godot. However, when compiling godot_cpp, it creates malformed function definitions:
```c++
void example_function(int input (1));
```
While this a fixable issue for me, there is a (very circumstantial) way to use this for code injection if the module came from a second party.
### Steps to reproduce
Compile godot with modules with malformed input descriptions. Create and move the custom.api. Compile the GDExtension Project.
### Minimal reproduction project
N/A
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.