29 lines
1.7 KiB
Markdown
29 lines
1.7 KiB
Markdown
# WBV2-P6-001 status
|
|
|
|
- task: `WBV2-P6-001`
|
|
- parent: `WBV2-P5-003`
|
|
- parity: `SECURITY.SCRIPTING`
|
|
- implementationClass: `EXCLUDED`
|
|
- status: `done`
|
|
- fixture: `tests/files/web/generated/WBV2-P6-001-SECURITY.SCRIPTING.blend`
|
|
|
|
## Evidence
|
|
|
|
- Blender desktop and WASM/Main expose the same read-only scripting policy receipt: autorun, network, add-on, driver-expression and module execution default to `DENY`.
|
|
- The receipt records a disabled sandbox, cancellation code `SCRIPT_SANDBOX_CANCELLED`, idempotent disposal state `RELEASED`, bounded budgets, and blocked DOM/worker/storage/network scope.
|
|
- A malicious Text source remains metadata-only; module autorun, unsigned execution, approved-key sandbox execution, late sandbox results, and filesystem escape are all rejected without publishing or changing Main.
|
|
- The policy Text and script source survive desktop and WASM save/reopen exactly. The updated C++ reader defines a typed `scriptingPolicy` snapshot field; the checked-in vendor WASM exposes the same canonical receipt through `texts` until rebuilt.
|
|
|
|
## Commands
|
|
|
|
- `build_blender_5.2.0/bin/blender -b --factory-startup --python tools/web/generated/WBV2-P6-001.py -- tests/files/web/generated/WBV2-P6-001-SECURITY.SCRIPTING.blend`
|
|
- `build_blender_5.2.0/bin/blender -b --factory-startup --python tools/web/check-wbv2-p6-001-desktop.py -- tests/files/web/generated/WBV2-P6-001-SECURITY.SCRIPTING.blend tests/golden/WBV2-P6-001/scripting-desktop-report.json`
|
|
- `node --check tools/web/check-generated-gap.mjs`
|
|
- `npm --prefix web run test:generated-gap -- --task WBV2-P6-001`
|
|
- `node tools/web/check-generated-gap.mjs --task WBV2-P6-001`
|
|
|
|
## Handoff
|
|
|
|
- nextTask: `WBV2-P6-002`
|
|
- queue mutation: allowed after manifest and parent hash validation
|