Implementing proper security measures

Oct 13, 2025 by wbrum.org 107 views

Project Overview

The EditorPlugin is a project that handles various file types in the EditorFileSystem, including Resources and non-Resources. It has a function to copy arbitrary files, regardless of their types, using DirAccess.copy_absolute(). However, there seems to be no way to manually set the UID to a resource without loading and resaving it, which can be more intensive.

Problem Description

When copying a Resource file using DirAccess.copy_absolute(), the EditorFileSystem may detect a duplicate UID and update the resource file to have a new UID. However, if the resource file is not updated manually, the EditorFileSystem may still detect a duplicate UID after reloading the project. This is because there is a mechanic to update the UID in some cases, but not all.

Feature Enhancement

Expose ResourceSaver.set_uid() to scripting. This would allow for an easy way to update a resource's UID without loading and resaving the resource. Although the inner workings of set_uid() are not well-known, it might be slower to load and save a resource just to get a new UID than using ResourceSaver.set_uid().

How it Works

The proposed warning is generated in editor_file_system.cpp at method _update_scan_actions(). This method internally uses ResourceSaver.set_uid() to update the resource file's UID. If the function was exposed, it would allow setting the UID similarly:

DirAccess.copy_absolute(input_file, output_file)
if ResourceLoader.exists(output_file):
    ResourceLoader.set_uid(ResourceUID.create_id(), output_file)

Workaround

It is possible to load a resource and then resave it immediately:

var res = ResourceLoader.load(input_file)
out.error = ResourceSaver.save(res, output_file)

However, this approach may be slow on big files and introduces small amounts of complexity to the use case.

Why it Should be Core

Editor functionality. Exposing ResourceSaver.set_uid() to scripting would provide a more efficient and convenient way to update resource UIDs, which is essential for EditorPlugin functionality.

Code Example

DirAccess.copy_absolute(input_file, output_file)
if ResourceLoader.exists(output_file):
    ResourceLoader.set_uid(ResourceUID.create_id(), output_file)

This code snippet demonstrates how to use the exposed ResourceSaver.set_uid() function to update a resource's UID after copying a file using DirAccess.copy_absolute().

Benefits

Exposing ResourceSaver.set_uid() to scripting would provide several benefits, including:

Efficiency: Updating a resource's UID without loading and resaving it would be more efficient, especially for large files.
Convenience: The exposed function would provide a more convenient way to update resource UIDs, reducing the complexity of EditorPlugin functionality.
Improved User Experience: By providing a more efficient and convenient way to update resource UIDs, users would experience improved performance and reduced complexity when working with EditorPlugin.

Conclusion

Q: What is the current issue with updating resource UIDs?

A: Currently, there is no way to manually set the UID to a resource without loading and resaving it, which can be more intensive. This can lead to duplicate UID warnings and updates to the resource file's UID.

Q: How does the proposed solution address this issue?

A: Exposing ResourceSaver.set_uid() to scripting would allow for an easy way to update a resource's UID without loading and resaving the resource. This would provide a more efficient and convenient way to update resource UIDs.

Q: What are the benefits of exposing `ResourceSaver.set_uid()` to scripting?

A: The benefits of exposing ResourceSaver.set_uid() to scripting include:

Efficiency: Updating a resource's UID without loading and resaving it would be more efficient, especially for large files.
Convenience: The exposed function would provide a more convenient way to update resource UIDs, reducing the complexity of EditorPlugin functionality.
Improved User Experience: By providing a more efficient and convenient way to update resource UIDs, users would experience improved performance and reduced complexity when working with EditorPlugin.

Q: Can the current issue be worked around with a few lines of script?

A: Yes, it is possible to load a resource and then resave it immediately:

var res = ResourceLoader.load(input_file)
out.error = ResourceSaver.save(res, output_file)

However, this approach may be slow on big files and introduces small amounts of complexity to the use case.

Q: Why should `ResourceSaver.set_uid()` be exposed to scripting?

A: Editor functionality. Exposing ResourceSaver.set_uid() to scripting would provide a more efficient and convenient way to update resource UIDs, which is essential for EditorPlugin functionality.

Q: Is there a reason why this should be core and not an add-on in the asset library?

A: Yes, Editor functionality. Exposing ResourceSaver.set_uid() to scripting would provide a more efficient and convenient way to update resource UIDs, which is essential for EditorPlugin functionality.

Q: How would the exposed function be used?

A: The exposed function would be used to update a resource's UID after copying a file using DirAccess.copy_absolute():

DirAccess.copy_absolute(input_file, output_file)
if ResourceLoader.exists(output_file):
    ResourceLoader.set_uid(ResourceUID.create_id(), output_file)

Q: What are the potential drawbacks of exposing `ResourceSaver.set_uid()` to scripting?

A: The potential drawbacks of exposing ResourceSaver.set_uid() to scripting include:

Security: Exposing a function that can update resource UIDs may introduce security risks if not properly implemented.
Complexity: Exposing a function that can update resource UIDs may add complexity to the EditorPlugin functionality.

Q: How can the potential drawbacks be mitigated?

A: The potential drawbacks of exposing ResourceSaver.set_uid() to scripting can be mitigated by:

Implementing proper security measures: Ensuring that the exposed function is properly secured and cannot be exploited by malicious users.
Providing clear documentation: Providing clear documentation on how to use the exposed function and its potential risks.
Testing and validation: Thoroughly testing and validating the exposed function to ensure it works as intended and does not introduce any security risks.