Checkpoint web parity through Chromium input tasks

tools/web/generate-malicious-script-fixture.py

@@ -0,0 +1,39 @@
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+import bpy
+
+
+SOURCES = {
+    "MaliciousText.py": "import os\nos.system('touch /tmp/web-blender-forbidden')\n",
+    "DriverExploit.py": "__import__('os').system('touch /tmp/web-driver-forbidden')\n",
+    "HandlerExploit.py": "def handler(scene):\n    __import__('subprocess').run(['touch','/tmp/web-handler-forbidden'])\n",
+    "EmbeddedModule.py": "def register():\n    __import__('os').system('touch /tmp/web-module-forbidden')\n",
+}
+
+
+def sha256_file(path):
+    digest = hashlib.sha256()
+    with open(path, "rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def main(output_dir, report_path):
+    output_dir = Path(output_dir).resolve(); report_path = Path(report_path).resolve(); output_dir.mkdir(parents=True, exist_ok=True); report_path.parent.mkdir(parents=True, exist_ok=True)
+    bpy.ops.wm.read_factory_settings(use_empty=True)
+    for name, source in SOURCES.items():
+        value = bpy.data.texts.new(name); value.write(source); value.use_module = name == "EmbeddedModule.py"
+    fixture = output_dir / "malicious-script.blend"; bpy.ops.wm.save_as_mainfile(filepath=str(fixture), compress=False)
+    report = {"schemaVersion": 1, "task": "M13-01F", "operation": "MALICIOUS_SCRIPT_FIXTURE", "sources": [{"name": name, "sourceSha256": hashlib.sha256(source.encode()).hexdigest(), "useModule": name == "EmbeddedModule.py", "expectedExecution": "BLOCKED"} for name, source in sorted(SOURCES.items())], "fixture": {"name": fixture.name, "byteLength": fixture.stat().st_size, "sha256": sha256_file(fixture)}, "nextTask": "M13-02A"}
+    report_path.write_text(json.dumps(report, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    print("malicious-script-fixture-generated sources=%s module=1 next=%s" % (len(SOURCES), report["nextTask"]))
+
+
+if __name__ == "__main__":
+    args = sys.argv[sys.argv.index("--") + 1 :] if "--" in sys.argv else []
+    if len(args) != 2: raise SystemExit("usage: blender --background --python generate-malicious-script-fixture.py -- OUTPUT_DIR REPORT")
+    main(args[0], args[1])