Different levels of resource filtering

[TorutheRedFox]

At the moment, resources are either filtered or not, but a good feature would be to have multiple levels of filtration, ranging from protecting against potentially dangerous resources (i.e. scripts) to only allowing resources that the retail game can generate on its own

[m88youngling]

I think I heard one of the devs talking about this the other day. So, are you describing how scripts could be hidden inside a level's resources as normal data and this needs to be patched, or is this a separate topic?

[TorutheRedFox]

ok so here's my view on common resource types

RMesh: allow it after screening the file and its dependencies for any malicious content/exploits
RScript: unless you can decompile and analyze them, no
RGfxMaterial: no because of zero cross-compatibility between games, unless you want to add a mechanism for limiting compatibility to a single game on the server side
RTexture: what harm could that cause? it's basically sent straight to the GPU after decompression
anything else: screen it for possible exploits and allow it if its dependencies also pass

as for dependencies, keep a log of a file and delete it if a dependency for it comes in that gets rejected

[TorutheRedFox]

there's also a few resource types that make zero sense to be uploaded, like RPixelShader, RVertexShader, RSPUElf, etc.

[Slendy]

As far as I know the game never uploads a mesh file naturally. It has to be modded in somehow so it doesn’t really have a place besides on instances wanting modded content. I already added functionality for reading dependencies of resources and it should be trivial for someone to fork Lighthouse and adjust the resource filtering. Also, can’t you already upload texture files with no issues?

[TorutheRedFox]

I'm talking about modded content for a less strict content filtering mode so the instance is still (at least somewhat) secure from resource-related ingame exploits but still allows for modding, meanwhile the more strict mode would just allow resources that the game itself would generate under normal circumstances to be uploaded (as in no security, lax security allowing for mods, or strict security that enforces vanilla content)

[m88youngling]

ok so here's my view on common resource types

RMesh: allow it after screening the file and its dependencies for any malicious content/exploits RScript: unless you can decompile and analyze them, no RGfxMaterial: no because of zero cross-compatibility between games, unless you want to add a mechanism for limiting compatibility to a single game on the server side RTexture: what harm could that cause? it's basically sent straight to the GPU after decompression anything else: screen it for possible exploits and allow it if its dependencies also pass

as for dependencies, keep a log of a file and delete it if a dependency for it comes in that gets rejected

This is some fascinating stuff, I've never seen these categorized like that. I don't know a whole lot about it, so it's great to see your perspective