architect-bot
4da8687f2c
Verified all three options from the task against Godot 4.6.2 directly (godot --headless), rather than trusting the probe scripts' own printed output from earlier sessions: - ScriptServer doesn't exist as a class; no disable_os/disable_file_access/ disable_network project settings exist either. Nothing to configure. - SubViewport isolates rendering/input only, not script capabilities — a script inside one has identical OS/FileAccess/network access. - Expression is not safe by default (can still reach unsafe methods through a base instance); blocklisting dangerous substrings is trivially bypassed. Recommendation: don't sandbox GDScript in-process (nothing to sandbox with) — use a narrow non-Turing-complete content DSL for the common case, and OS-level process isolation only if genuinely general scripting turns out to be required.
7 lines
193 B
GDScript
7 lines
193 B
GDScript
extends SceneTree
|
|
func _init():
|
|
print("ScriptServer class exists: ", ClassDB.class_exists("ScriptServer"))
|
|
var sv = SubViewport.new()
|
|
print("SubViewport instantiated: ", sv != null)
|
|
quit()
|