Fix Issue #2109: Implement V8 bytecode-only security enhancement - #2151
Closed
caiyunbo666 wants to merge 96 commits into
Closed
Fix Issue #2109: Implement V8 bytecode-only security enhancement#2151caiyunbo666 wants to merge 96 commits into
caiyunbo666 wants to merge 96 commits into
Conversation
…cent#2112) * test: arraybuffer from c# should be copied * fix: arraybuffer from c# should be copied --------- Co-authored-by: bingcongni <bingcongni@tencent.com>
(cherry picked from commit 53ae303c34c9169a1f38109a417f6ae2b9439d61) Co-authored-by: corejiang <corejiang@tencent.com>
Co-authored-by: corejiang <corejiang@tencent.com>
…encent#2119) * verify PackageExist before StaticLoadObject * fix clang format
…ph方法导致死循环) (Tencent#2126) 2.异步加载 还没有postload时 缓存了错误的空方法复原导致空指针调用崩溃（两个条件：1. postload没有调用 2. js module加载失败，例如删了ts和js被删了 但是TS代理蓝图还在使用）
(cherry picked from commit 9559763)
2.兼容gen full -full
…n2那样先转换再获取utf16字符串
* [unity]test: 增加无效UnityEngine.Object实例传输的用例 * [untiy]feat: il2cpp模式下将无效UnityEngine.Object实例以null对象传递给脚本 * [unity]feat: 优化unity引擎对象的判空实现 * [unity] test: 在非unity环境下屏蔽PassDestroyedUnityObjectTest用例 --------- Co-authored-by: corejiang <corejiang@tencent.com>
…encent#2130) * [unreal]修复静态绑定中作为参数的std::function类型的参数如果包含TArray等容器类的时候，自动生成的TS声明会被错误的添加cpp.前缀的问题 * 通过clang-format格式化
… JS-C# calls - Add exception handling for InspectorTick in both Default and IL2CPP JsEnv - Implement timeout mechanism for WaitDebugger to prevent infinite loops - Add V8 exception catching in native JSEngine.cpp - Enhance BackendEnv.cpp with C++ exception protection - Add comprehensive test cases for multi-layer debugging scenarios - Include Unity test script for runtime verification - Add CPU optimization to reduce resource usage during debugging
- Convert all Chinese comments to English to match project style - Remove MD documentation files as requested - Remove test files with Chinese comments - Ensure all comments follow the original project's English convention
Collaborator
|
我看你的提交是实现字节码？ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR implements the security enhancement requested in Issue #2109 to remove V8's source code compilation functionality and allow only bytecode loading for enhanced security.
Changes Made
Core Security Implementation
Modified
unity/native_src/Src/JSEngine.cppEval()function.cbcand.mbcfilesModified
unity/native_src/Src/BackendEnv.cppFetchModuleTree()--no-lazy--no-flush-bytecode--no-enable-lazy-source-positions--disable-source-maps--disable-source-positionsEnhanced
unity/v8cc/v8cc.ccSecurity Features
.jsand.mjsfiles are rejected at runtime.cbc(CommonJS) and.mbc(ES Module) files are acceptedBenefits
Breaking Changes
.js,.mjs) are rejectedv8cctoolMigration Guide
For existing projects:
.jsfiles to.cbcusing thev8cctoolRelated Issue
Closes #2109