Particle effect files are procedurally generated python code. When they're loaded, they're simply ran using python's exec() function. Ideally, there would be some other method of storing and loading this data that's safer; (I've done something similar using DatagramInputFile and DatagramOutputFile;) but at the very least programmers should be warned about this vulnerability without having to read the particle system's source code.
For instance, a bad actor could distribute malware within a graphical overhaul mod to someone's game this way. When the replaced particle effect gets loaded, the new python code downloads and installs the malware without the user knowing. Admittedly this is a possibility than something one could expect to happen, but there already is a precedent for graphical overhaul packs being made for panda3d-based games. cough-a certain MMO-cough.
Particle effect files are procedurally generated python code. When they're loaded, they're simply ran using python's exec() function. Ideally, there would be some other method of storing and loading this data that's safer; (I've done something similar using DatagramInputFile and DatagramOutputFile;) but at the very least programmers should be warned about this vulnerability without having to read the particle system's source code.
For instance, a bad actor could distribute malware within a graphical overhaul mod to someone's game this way. When the replaced particle effect gets loaded, the new python code downloads and installs the malware without the user knowing. Admittedly this is a possibility than something one could expect to happen, but there already is a precedent for graphical overhaul packs being made for panda3d-based games. cough-a certain MMO-cough.