I’m making a game where people update a model which is a MeshInstance3D by editing blend shape values, applying materials, adding attachments via child nodes (which are also MeshInstance3D nodes.) In an ideal world, I would simply have the user save these as resource files, but I have read that these can be vulnerable to injection attacks and I’ve read conflicting information about whether this can be sanitized using an addon. I guess my question is two-fold. Can resource files be adequately sanitized? If not, how can I save a Mesh using gdscript?
read about var_to_bytes_with_objects() and PackedByteArray
and methods like reverse(), compress() and append()
you may encode it and decode binary data and get it back as object bytes_to_var_with_objects()
or even use Crypto class
then save it using FileAccess class, there many examples how to save.
this method saves raw bytes, its not a resource, you may append some bad bytes to mix with it, reverse and compress, to make it not obvious to read