installs & compiles but has test errors
aside from expected merge conflicts, notable changes from upstream:
- removed husky, commitlint, etc.
- removed semantic-release etc.
While this is not believed to cause security bugs as this is not
interpeted as HTML, the inconsistent/no escaping causes bugs such as:
https://github.com/TurboWarp/extensions/issues/241
To resolve this, we now fully escape (hopefully) every value from
extensions that makes its way into XML, so now the characters:
" ' < > &
can be used anywhere in extensions without issues, even opcodes,
argument names, field names, etc. Just not the extension ID.
Some parts of Scratch such as ExtensionManager._sanitizeID and
Runtime._convertPlaceholders tried to explicitly remove XML characters,
however the code was broken (they only removed the first occurrence) and
this seems like the wrong fix anyways. We can use XML characters, they just
need to be escaped.
Also includes a very comprehensive test.
This is a breaking change.
Replaces logic that was previously in our scratch-gui fork.
Upstream does the opposite; they disable cloud variables when video
sensing is used. We can't do the same because of custom extensions.
Disabling all custom extensions when video sensing is used would be too
limiting. The concern with custom extensions is not that they will steal
private skins, but that a project could use their blocks to fetch()
color information to a remote server similar to cloud variables.
The end result is not dissimilar: Cloud variables and video sensing
shouldn't be used together.
The parameters didn't work in the way that you would expect. Only the
values provided in the first call to addAddonBlock would do anything,
and this gives a false impression that this will color the blocks in the
editor. Color options may be re-added in the future as part of a more
significant API update.
This fixes a Scratch bug affecting custom extensions.
There were two bugs in the interpreter:
- Thread status wouldn't reset after promise resolves
- Loop finding logic broke on hats and mangled the stack
Muffin