lotobo/3d-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Release 3D Tools 0.2.0
Verify / verify (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
zemion
2026-09-02 09:56:02 +02:00
parent b20c67c890
commit f838480278
31 changed files with 1347 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+12 -2
View File
@@ -1,5 +1,15 @@
# Security policy
Report vulnerabilities privately to the repository owner. Supported version: 0.1.x.
Report vulnerabilities privately to the repository owner. Supported version: 0.2.x.
3D Tools makes no uploads, telemetry or third-party requests. JSON is parsed as inert data under text, depth, node and token-count bounds. Exporters escape Android XML and quote Swift strings. Generated source remains an input to another toolchain and must be reviewed before production use.
3D Tools makes no uploads, telemetry or third-party requests. OBJ, STL, PLY and
glTF/GLB files are treated as untrusted data under documented byte, JSON,
geometry and scene-graph bounds. Parsing runs in a disposable worker, and
revision-scoped results prevent cancelled or superseded jobs from replacing
newer state.
External glTF resources are rejected, data URIs are decoded locally, and OBJ
material-library references are never fetched. Imported text cannot become
HTML, JavaScript or shader source. WebGL receives finite numeric arrays and
fixed application-owned shaders; a preview failure does not block inspection,
repair or export.