Shutong Wu
2efb786042
Security review + code review of the asset-gen feature surfaced concrete issues;
this fixes them and adds regression tests (request-shaping layer, FakeHttpTransport).
Security
- SafeZipExtractor enforces an extension allowlist; ModelImportPipeline passes an
inert model/texture allowlist so a provider archive can't drop a .cs/.dll under
Assets/ and have the Editor compile/load it (code execution on import).
- AssetGenJobManager refuses non-http(s) download URLs before fetching
(file:// SSRF / local-file read into the project).
Provider correctness
- Meshy image->3D polls /openapi/v1/image-to-3d/{id} (was the v2 text URL).
- Meshy text->3D honors texture=true via the preview->refine two-phase flow.
- OpenRouter image->image attaches the reference image (content image_url part).
- fal image->image uses the /edit endpoint + image_urls array; width/height
forwarded as image_size.
- Sketchfab search forwards categories/count/cursor/downloadable; preview doc
corrected (returns metadata, not a base64 thumbnail).
- Job import calls AssetDatabase.Refresh() before importing a freshly written file.
Local image input (image_path)
- New LocalImage helper; image_path is read and sent inline as a base64 data URI
for Meshy / fal / OpenRouter. Tripo rejects local images with a clear error
(needs a hosted image_url; its upload flow is not wired).
Cleanup (no behavior change)
- Shared AssetGenPaths + ProviderHttp helpers, HttpResult.Ok, MissingKeyMessage,
cached glTFast probe, dead-field / per-frame-alloc removal, CLI _emit.
Docs: README + manual-verification updated (image_path support; transparency is
import-flag-only; width/height fal-only).
Verified: package compiles clean; Python 1306 passed / 3 skipped. Meshy refine,
fal /edit, and image_path data-URI paths are unit-tested at the request layer
only -- live smoke per provider (real keys) still pending.
Claude-Session: https://claude.ai/code/session_015DAUrMR5UaSEzEn2wNPrEP
20 lines
739 B
C#
20 lines
739 B
C#
namespace MCPForUnity.Editor.Services.AssetGen.Http
|
|
{
|
|
/// <summary>
|
|
/// Transport-agnostic result of an <see cref="HttpRequestSpec"/>. <see cref="Status"/> is
|
|
/// the numeric HTTP status code; <see cref="IsSuccess"/> reflects the transport's own view
|
|
/// of success (e.g. UnityWebRequest.Result.Success), which adapters combine with their own
|
|
/// body-level checks.
|
|
/// </summary>
|
|
public sealed class HttpResult
|
|
{
|
|
public int Status;
|
|
public byte[] Body;
|
|
public string Text;
|
|
public bool IsSuccess;
|
|
|
|
/// <summary>True when the transport reports success or the status code is 2xx.</summary>
|
|
public bool Ok => IsSuccess || (Status >= 200 && Status < 300);
|
|
}
|
|
}
|