Release 3D Tools 0.2.0

2026-09-02 09:56:02 +02:00
parent b20c67c890
commit f838480278
31 changed files with 1347 additions and 145 deletions
@@ -1,5 +1,15 @@
 # Security policy

-Report vulnerabilities privately to the repository owner. Supported version: 0.1.x.
+Report vulnerabilities privately to the repository owner. Supported version: 0.2.x.

-3D Tools makes no uploads, telemetry or third-party requests. JSON is parsed as inert data under text, depth, node and token-count bounds. Exporters escape Android XML and quote Swift strings. Generated source remains an input to another toolchain and must be reviewed before production use.
+3D Tools makes no uploads, telemetry or third-party requests. OBJ, STL, PLY and
+glTF/GLB files are treated as untrusted data under documented byte, JSON,
+geometry and scene-graph bounds. Parsing runs in a disposable worker, and
+revision-scoped results prevent cancelled or superseded jobs from replacing
+newer state.
+
+External glTF resources are rejected, data URIs are decoded locally, and OBJ
+material-library references are never fetched. Imported text cannot become
+HTML, JavaScript or shader source. WebGL receives finite numeric arrays and
+fixed application-owned shaders; a preview failure does not block inspection,
+repair or export.