Document GDScript sandboxing findings and recommendation

Verified all three options from the task against Godot 4.6.2 directly
(godot --headless), rather than trusting the probe scripts' own printed
output from earlier sessions:
- ScriptServer doesn't exist as a class; no disable_os/disable_file_access/
  disable_network project settings exist either. Nothing to configure.
- SubViewport isolates rendering/input only, not script capabilities — a
  script inside one has identical OS/FileAccess/network access.
- Expression is not safe by default (can still reach unsafe methods through
  a base instance); blocklisting dangerous substrings is trivially bypassed.

Recommendation: don't sandbox GDScript in-process (nothing to sandbox
with) — use a narrow non-Turing-complete content DSL for the common case,
and OS-level process isolation only if genuinely general scripting turns
out to be required.

This commit is contained in:

architect-bot

2026-08-17 23:43:48 +00:00

parent 119cd9400a

commit 4da8687f2c

2 changed files with 165 additions and 0 deletions

									
										sandbox_probe/probe_scriptserver_check.gd
									
		+6
		
												View File
												
				@@ -0,0 +1,6 @@

				extends SceneTree

				func _init():

					print("ScriptServer class exists: ", ClassDB.class_exists("ScriptServer"))

					var sv = SubViewport.new()

					print("SubViewport instantiated: ", sv != null)

					quit()