Rebuild local Blender WASM environment and recovery evidence

2026-08-27 20:15:55 +08:00
parent a081c68c87
commit c2c65d3a09
376 changed files with 241951 additions and 114 deletions
--- a/tools/web/generated/WBV2-P6-001.py
+++ b/tools/web/generated/WBV2-P6-001.py
@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+import hashlib
+import json
+import pathlib
+import sys
+
+import bpy
+
+
+def digest(value):
+    payload = value.encode("utf-8") if isinstance(value, str) else value
+    return hashlib.sha256(payload).hexdigest()
+
+
+def main(output):
+    bpy.ops.wm.read_factory_settings(use_empty=True)
+    scene = bpy.context.scene
+    scene.name = "WBV2P6001ScriptingSecurityScene"
+    scene.render.engine = "BLENDER_EEVEE"
+    scene.render.resolution_x = 32
+    scene.render.resolution_y = 32
+    scene.render.resolution_percentage = 100
+
+    source = "import os\nimport socket\nopen('../escape.txt', 'w')\nprint('secret-token')"
+    malicious = bpy.data.texts.new("WBV2-P6-001-MaliciousScript")
+    malicious.write(source)
+    malicious.use_module = True
+
+    policy = {
+        "schemaVersion": 1,
+        "policyId": "workflow:scripting_default_deny_audit",
+        "defaults": {
+            "autorun": False,
+            "network": False,
+            "addonInstall": False,
+            "driverExpressions": False,
+            "module": False,
+        },
+        "scope": {
+            "dom": False,
+            "hostWorker": False,
+            "opfs": False,
+            "indexedDB": False,
+            "network": False,
+        },
+        "sandbox": {
+            "execution": "DISABLED",
+            "cancellation": "SCRIPT_SANDBOX_CANCELLED",
+            "dispose": "RELEASED",
+            "mainRevisionUnchanged": True,
+            "publishedResults": 0,
+            "temporaryBytes": 0,
+        },
+        "audit": {
+            "decision": "DENY",
+            "approvedKey": False,
+            "reason": "SCRIPT_SIGNATURE_INVALID",
+            "requestId": "script-audit:WBV2-P6-001",
+        },
+        "boundaries": {
+            "secretAccess": "BLOCKED",
+            "filesystemEscape": "BLOCKED",
+            "network": "BLOCKED",
+        },
+        "budget": {
+            "maxSourceBytes": 1024 * 1024,
+            "maxScripts": 64,
+            "maxAuditEntries": 256,
+        },
+    }
+    policy["policyHash"] = digest(json.dumps(policy, sort_keys=True, separators=(",", ":")))
+    receipt = bpy.data.texts.new("WBV2-P6-001-ScriptingPolicyReceipt")
+    receipt.write(json.dumps(policy, sort_keys=True, separators=(",", ":")))
+    scene.frame_set(1)
+    bpy.ops.wm.save_as_mainfile(filepath=str(pathlib.Path(output).resolve()), check_existing=False, compress=True)
+
+
+if __name__ == "__main__":
+    arguments = sys.argv[sys.argv.index("--") + 1 :]
+    if len(arguments) != 1:
+        raise SystemExit("usage: blender -b --factory-startup --python WBV2-P6-001.py -- OUTPUT")
+    main(arguments[0])