Support remote URLs in Node.js and CLI

As per the specifications external URLs for assets are not forbidden in gltfs for textures and .bins.

Somehow, the cli utility is trying to fetch the url from the current path:

error: ENOENT: no such file or directory, open '/Users/daniel/Desktop/https:/cdn.exmaple.io/dvpt-dg/shared_assets/files/000/001/465/9e3f8087b67dcaf4d1bed33bd23699b760637e6bf2e3a2c7883dc2e6933c9e04-optimised_jpg.jpg'

Am I missing something here?

I understand that validate would say :

Non-relative URI found: 'https://....jpg'.glTF Validator(NON_RELATIVE_URI)

But this shouldn’t block the other cli commands.

Any thoughts?

[donmccurdy]

Fixed by @HexaField in https://github.com/donmccurdy/glTF-Transform/pull/462, with a few more changes to the API coming in #466. This will be published with v2.0.

[donmccurdy]

Aside — a word on security. Be careful about accepting user-generated content (UGC) from untrusted sources. Users can do evil things. Suppose you have a server endpoint that accepts user-generated GLBs, compresses them, and sends them back to the user. The user could put an “image” into the GLB with a “URL” pointing at some secret file from your server’s disk, and NodeIO’s writeBinary method would read that secret file and embed it into the resulting GLB. While the addition of a setAllowHTTP(...) method is convenient, this library doesn’t know your use cases and application context, and where UGC is involved you’ll probably want to be manually handling HTTP requests, checking URLs and paths on disk, and perhaps re-compressing images. Those risks aren’t new with support for HTTP requests, but it does add a couple more attack vectors when enabled.

It might also be nice to expose an io.setAllowFilesystem(bool) method so that users can disable disk access if they don’t need it.