processing / processing/processing4
Implement warning message when opening .pdex or .pdez files
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 494
- Forks
- 183
- Avg merge
- 4h 39m
- Merged PRs (30d)
- 3
Description
Created by: SableRaf
Currently, it is possible to open and run a .pdez or .pdex file downloaded from the web without any extra steps. It could be wise to add a warning when opening a bundled sketch/mode/tool/library to tell a user to only run third-party code if they trust the author (similar to VSCode's restricted mode).
Note: Unlike VSCode and its extensions, the PDE won't run arbitrary code just when you open a sketch so this is is not an apples to apples comparison, but since we made it easier to execute arbitrary code on a machine running the PDE, it might still be a good idea to add that extra layer of security.
Edit: this was initially mentioned here https://github.com/processing/processing4/issues/559
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the PDE open and run flow for bundled .pdex and .pdez files, including sketches, modes, tools, and libraries. Done means users see a trust warning before running downloaded third-party code, with behavior aligned to the intended security scope.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- desktop, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100