Skip to content

Commit

Permalink
@GGScdipt Doc: advising against using load for untrusted resoruces du…
Browse files Browse the repository at this point in the history
…e to possible Remote Code xecution.
  • Loading branch information
betalars committed Oct 14, 2024
1 parent 3b11e68 commit 0f1bdde
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions modules/gdscript/doc_classes/@GDScript.xml
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@
[/codeblock]
[b]Important:[/b] Relative paths are [i]not[/i] relative to the script calling this method, instead it is prefixed with [code]"res://"[/code]. Loading from relative paths might not work as expected.
This function is a simplified version of [method ResourceLoader.load], which can be used for more advanced scenarios.
[b]Warning:[/b] Do not use this for save files, as it may lead to remote code execution when users share saves. You should only use this to load files that you know are trusted. [b]Warning:[/b] Do not use this for save files, as it may lead to remote code execution when users share saves. You should only use this to load files that you know are trusted. Read the "Saving Games" tutorial for further guidance.
[b]Note:[/b] Files have to be imported into the engine first to load them using this function. If you want to load [Image]s at run-time, you may use [method Image.load]. If you want to import audio files, you can use the snippet described in [member AudioStreamMP3.data].
[b]Note:[/b] If [member ProjectSettings.editor/export/convert_text_resources_to_binary] is [code]true[/code], [method @GDScript.load] will not be able to read converted files in an exported project. If you rely on run-time loading of files present within the PCK, set [member ProjectSettings.editor/export/convert_text_resources_to_binary] to [code]false[/code].
</description>
Expand Down

0 comments on commit 0f1bdde

Please sign in to comment.