Cookie🍪🔜 Megaplex

@realcookii.bsky.social

21 🇳🇱 / Artist / Game Developer / SFW more at https://realcookiii.carrd.co/ https://ko-fi.com/realcookii

insane Godot design decision of the day: `bytes_to_var` doesn't deserialize objects but `str_to_var` does, leading to code execution with absolutely no warning about it. there is a 3 yrs open issue for this problem and one of the comments with 50 likes is "hidden as abuse" github.com/godotengine/...

`str_to_var` and `ConfigFile` allow for arbitrary code execution · Issue #80562 · godotengine/godot

Godot version v4.1.1.stable.official [bd6af8e] System information Ubuntu 23.04 Issue description The global method str_to_var and ConfigFile's load/parse methods deserialize variants from strings, ...

github.com