62 lines
2.4 KiB
Python
62 lines
2.4 KiB
Python
#!/usr/bin/env python3
|
|
import hashlib
|
|
import json
|
|
import pathlib
|
|
import sys
|
|
|
|
import bpy
|
|
|
|
|
|
def state():
|
|
scene = bpy.context.scene
|
|
receipt = bpy.data.texts.get("WBV2-P6-001-ScriptingPolicyReceipt")
|
|
malicious = bpy.data.texts.get("WBV2-P6-001-MaliciousScript")
|
|
if receipt is None or malicious is None:
|
|
raise RuntimeError("scripting policy fixture is missing receipt or source")
|
|
return {
|
|
"sceneId": "scene:" + scene.name,
|
|
"receipt": json.loads(receipt.as_string()),
|
|
"source": malicious.as_string(),
|
|
"useModule": malicious.use_module,
|
|
}
|
|
|
|
|
|
def main():
|
|
arguments = sys.argv[sys.argv.index("--") + 1 :]
|
|
if len(arguments) != 2:
|
|
raise SystemExit("usage: blender -b --factory-startup --python check-wbv2-p6-001-desktop.py -- FIXTURE REPORT")
|
|
fixture, output = (pathlib.Path(value).resolve() for value in arguments)
|
|
bpy.ops.wm.open_mainfile(filepath=str(fixture), load_ui=False)
|
|
before = state()
|
|
temporary = fixture.with_name(f"{fixture.stem}-reopen.blend")
|
|
try:
|
|
bpy.ops.wm.save_as_mainfile(filepath=str(temporary), check_existing=False, compress=True)
|
|
bpy.ops.wm.open_mainfile(filepath=str(temporary), load_ui=False)
|
|
after = state()
|
|
finally:
|
|
temporary.unlink(missing_ok=True)
|
|
if before != after:
|
|
raise RuntimeError(f"scripting policy save/reopen drift: {before} != {after}")
|
|
policy = after["receipt"]
|
|
if policy["defaults"] != {"addonInstall": False, "autorun": False, "driverExpressions": False, "module": False, "network": False}:
|
|
raise RuntimeError("scripting policy defaults are not deny-by-default")
|
|
if policy["boundaries"] != {"filesystemEscape": "BLOCKED", "network": "BLOCKED", "secretAccess": "BLOCKED"}:
|
|
raise RuntimeError("scripting policy boundaries are not blocked")
|
|
report = {
|
|
"schemaVersion": 1,
|
|
"task": "WBV2-P6-001",
|
|
"operation": "SECURITY_SCRIPTING_DESKTOP_METADATA",
|
|
"fixtureSha256": hashlib.sha256(fixture.read_bytes()).hexdigest(),
|
|
"state": after,
|
|
"execution": "DISABLED",
|
|
"saveReopen": "EXACT",
|
|
"blenderVersion": bpy.app.version_string,
|
|
}
|
|
output.parent.mkdir(parents=True, exist_ok=True)
|
|
output.write_text(json.dumps(report, indent=2, sort_keys=True) + "\n", encoding="utf-8")
|
|
print("wbv2-p6-001-desktop-ok defaults=deny sandbox=disabled boundaries=blocked saveReopen=exact")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|