qssggltfresourceresolver.cpp

Go to the documentation of this file.

// Copyright (C) 2026 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only
// Qt-Security score:critical reason:data-parser
 
#include "qssggltfresourceresolver_p.h"
 
#include <QtCore/qdir.h>
#include <QtCore/qfile.h>
#include <QtCore/qurl.h>
 
QT_BEGIN_NAMESPACE
 
/*!
    \namespace QSSGGltfResourceResolver
    \internal
 
    Resolves glTF URIs: data: URIs (base64 or percent-encoded), and relative
    or absolute file paths, including Qt resource (":/...") paths.
*/
namespace QSSGGltfResourceResolver {
 
/*!
    \internal
 
    Returns whether \a uri is a data: URI.
*/
bool isDataUri(QStringView uri)
{
    return uri.startsWith(QLatin1String("data:"), Qt::CaseInsensitive);
}
 
/*!
    \internal
 
    Decodes the payload of the data: URI \a uri. Returns an empty array and
    sets \a errorMessage on failure.
*/
QByteArray decodeDataUri(QStringView uri, QString *errorMessage)
{
    // data:[<mediatype>][;base64],<payload>
    const qsizetype comma = uri.indexOf(u',');
    if (!isDataUri(uri) || comma < 0) {
        if (errorMessage)
            *errorMessage = QStringLiteral("Malformed data URI");
        return {};
    }
 
    const QStringView header = uri.mid(0, comma);
    const QStringView payload = uri.mid(comma + 1);
 
    if (header.endsWith(QLatin1String(";base64"), Qt::CaseInsensitive)) {
        auto result = QByteArray::fromBase64Encoding(payload.toLatin1());
        if (!result) {
            if (errorMessage)
                *errorMessage = QStringLiteral("Invalid base64 payload in data URI");
            return {};
        }
        return result.decoded;
    }
 
    // Non-base64 data URIs carry percent-encoded octets. Decoding has to stay
    // in QByteArray: going through QString would replace every octet sequence
    // that is not valid UTF-8 with U+FFFD, changing both the contents and the
    // length of what is meant to be arbitrary binary data.
    return QByteArray::fromPercentEncoding(payload.toLatin1());
}
 
/*!
    \internal
 
    Resolves the relative file URI \a uri against \a baseDir to a local or qrc
    path. The URI is percent-decoded as required by the glTF specification.
 
    A URI that would reach outside \a baseDir is rejected, which returns an
    empty string. The specification only allows relative references here, so
    an absolute path or one climbing out with ".." is malformed rather than
    merely unusual, and refusing it keeps a hostile asset from naming an
    arbitrary file for the application to load and read back.
*/
QString resolveFilePath(QStringView uri, const QString &baseDir)
{
    // glTF URIs are percent-encoded relative URI references
    const QString decoded = QUrl::fromPercentEncoding(uri.toUtf8());
    if (decoded.isEmpty())
        return {};
    if (QDir::isAbsolutePath(decoded) || decoded.startsWith(QLatin1String(":/")))
        return {};
    if (baseDir.isEmpty())
        return QDir::cleanPath(decoded).startsWith(QLatin1String("..")) ? QString() : decoded;
 
    const QString base = QDir::cleanPath(baseDir);
    const QString resolved = QDir::cleanPath(base + QLatin1Char('/') + decoded);
    if (resolved != base && !resolved.startsWith(base + QLatin1Char('/')))
        return {};
    return resolved;
}
 
/*!
    \internal
 
    Loads the contents referenced by the glTF URI \a uri: data: URIs are
    decoded, anything else is treated as a file path relative to \a baseDir.
    Sets \a errorMessage on failure.
*/
QByteArray loadUri(QStringView uri, const QString &baseDir, QString *errorMessage)
{
    if (isDataUri(uri))
        return decodeDataUri(uri, errorMessage);
 
    const QString path = resolveFilePath(uri, baseDir);
    if (path.isEmpty()) {
        if (errorMessage)
            *errorMessage = QStringLiteral("Refusing to resolve '%1' outside the asset directory").arg(uri);
        return {};
    }
 
    QFile file(path);
    if (!file.open(QIODevice::ReadOnly)) {
        if (errorMessage)
            *errorMessage = QStringLiteral("Failed to open '%1': %2").arg(path, file.errorString());
        return {};
    }
    return file.readAll();
}
 
} // namespace QSSGGltfResourceResolver
 
QT_END_NAMESPACE