The sweeps in command_sweep.rs kept their own list of file and folder
keys (path, diffPath, folder, destinationFolder) in testkit's
safe_value and again in the temp-folder test, so a command whose file
key was not on the list was sent raw junk strings, and a key written as
`{path | name ...}` (document.open) was never swept.
- The engine exports the plug-in call rules' file keys as
`cmd::key_location`, `cmd::location_in` and `cmd::location_keys`,
which read every key a params description names, the keys of the
commands its `...` entries name, and the schema. `diffPath` is a file
key, so a plug-in call that carries it is refused; Slice Options'
`url` and Export for Screens' `folders` name part of the document, so
a call to object.slice.options with a top-level `url` is accepted.
- testkit's `param_keys` reads the keys the engine reads, and
`junk_params_for_command` and `safe_value_for_command` send every
string under a file or folder key, in arrays and in objects inside
them, as a location in the sweep's temp folder. Each such key also
gets a list of paths and a list of `{ids, path}` objects.
- Every catalog sweep, the serializability sweep included, uses them,
and the temp-folder test checks every key the catalog names, at any
depth.
A call whose arguments hold a file or folder key at any depth, such as an
effect's textureImage.path, is refused before the command runs; the walk
keeps its own stack. Each call also runs with automation file access
confined to no roots, so every checked read or write a command makes is
refused, whichever param carried the path.
A run that calls imageTrace.make used to take the trace the app handed in
for the command, and a failed run did not give it back. The trace is now
set aside while the run goes and handed back after it.
A command's result describes the document, so a plug-in without doc.read
gets -6 for every call, whether or not the id names a command. A run that
calls commands commits an edit still in progress first and prepares its
input again when that changed the document or the selection.
A call was refused when any string in its arguments started with plugin., so a filter could not create text such as "plugin.example". Only the values of effect, effects, id (effect.apply's other name for effect), command and commands count now, at any depth.
A filter at plug-in API level 2 with the new `commands` permission names
the commands it may run in its manifest's `commandAllowlist` and runs
them with `env.vc_call`, reading each result with `env.vc_call_result`.
Each call runs through Session::execute on the run's document and sees
what earlier calls changed; the calls and the filter's output are one
undo step, and a run that fails, is cancelled or makes a failed call
leaves the documents, their history and the session state the commands
change as they were.
Commands that touch files, the clipboard, preferences, the view,
scripts, actions, plug-ins, open documents or the undo history are never
callable, and every other command must be listed as allowed in
cmd/plugin_call/reviewed.rs, so a new command is refused until placed.
Calls are capped at 1,000 a run, 8 MiB a call and 64 MiB a run, and each
costs instructions from the run's budget. plugin.install refuses a
manifest that lists a refused command and reports unknown ids;
plugin.inspect lists both, and the approval dialog lists the commands.
Refs #2186
dotCooCoo