While this is not believed to cause security bugs as this is not
interpeted as HTML, the inconsistent/no escaping causes bugs such as:
https://github.com/TurboWarp/extensions/issues/241
To resolve this, we now fully escape (hopefully) every value from
extensions that makes its way into XML, so now the characters:
" ' < > &
can be used anywhere in extensions without issues, even opcodes,
argument names, field names, etc. Just not the extension ID.
Some parts of Scratch such as ExtensionManager._sanitizeID and
Runtime._convertPlaceholders tried to explicitly remove XML characters,
however the code was broken (they only removed the first occurrence) and
this seems like the wrong fix anyways. We can use XML characters, they just
need to be escaped.
Also includes a very comprehensive test.
This is a breaking change.
Replaces logic that was previously in our scratch-gui fork.
Upstream does the opposite; they disable cloud variables when video
sensing is used. We can't do the same because of custom extensions.
Disabling all custom extensions when video sensing is used would be too
limiting. The concern with custom extensions is not that they will steal
private skins, but that a project could use their blocks to fetch()
color information to a remote server similar to cloud variables.
The end result is not dissimilar: Cloud variables and video sensing
shouldn't be used together.
The parameters didn't work in the way that you would expect. Only the
values provided in the first call to addAddonBlock would do anything,
and this gives a false impression that this will color the blocks in the
editor. Color options may be re-added in the future as part of a more
significant API update.
We don't want people to make a project in TW with 20 cloud variables and then have issues importing it to Scratch.
The packager, which has no limit, will convert any variable that starts with ☁ to a cloud variable, so this can be worked around.
Muffin