Please provide a method to generate VRCUrl at runtime for trusted domain URLs
tracked
ureishi
String/Image downloader has been implemented and there is a growing demand for dynamically generating URLs with Udon. However, I can understand that you are concerned about sending requests to URLs indiscriminately from the viewpoint of privacy protection.
Therefore, we request a function that can generate VRCUrl at runtime only for URLs that are listed in the trusted URL list.
For example, you can use it in U# code like this:
var urlStr = "https://youtube.com/" + "?v=PWLPw4RE9Ig";
VRCUrl resultUrl;
var success = VRCUrl.TryGenerateVRCUrl(urlStr, out resultUrl);
if(success)
{
videoPlayer.LoadUrl(resultUrl);
}
else
{
// `resultUrl` is null
Debug.Log($"Failed: the host of `{urlStr}` is not allowd to generate VRCUrl.");
}
If this is implemented, for example, it will be possible to read YouTube search results as a list of video IDs with String Downloader, create video URLs with
TryGenerateVRCUrl
, and input them to the video player.Log In
deavial
This needs to work for all URLs, not just trusted ones.
Genesis
Hopefully this will come with a way for users to add custom domains to their whitelist otherwise I don't see much use for this outside of generating YouTube URLs, and if you can curate your own whitelist this whole API becomes redundant since you could allow VRCURLs to be constructed normally and reject anything at the Video/Image/String downloader level that isn't on the whitelist when Allow Untrusted URLs is unchecked.
Dustuu
tracked
chiugame
Dustuu
How is your progress going?
There is an SDK function called VRCUrl.TryCreateAllowlistedVRCUrl, but it is not publicly available.
Is it related to this post?
P
Pale_Blue
Excuse me, is "TryGenerateVRCUrl" available now? I found "error CS0117: 'VRCUrl' does not contain a definition for 'TryGenerateVRCUrl' " in my unity editor.
Balphagore
Allowing us to pass parameters for many reasons would be helpful, and also the fact that I can lazy load content and pagination from my API as well as let users load their own configuration/profiles. Not great when a user joins there is hitching involved because I have to deserialize the massive chunk of data
As for those not aware, VRChat intentionally prevented the opportunity to create dynamic URL's at runtime. It is up to the user to input the URL in a field and then make the request. This is annoying to the user and if they use some fancy ASCII text they'll have to copy their name from a notepad every time they join the world.
VRChat should be aware that other games allow dynamic outbound URL's such as Roblox, Garry's Mod and other games including a number of social platforms. What is the harm of exfiltrating data from a world? Getting a list of usernames? They use VR? They Like to hang out in the hot tub of a world more than the pool of a world? Where's the harm in that?
Roblox is prideful in providing their API and explanation of it through their creator documentation because they believe in giving flexibility and features to their creators adding a better experience.
Flir
Glad to see this is being tracked, as this is effectively equivalent to a Canny I opened yesterday. Speaking from a security POV, I don't see any meaningful difference when it comes to security between dynamically constructing VRCUrls, and forcing them to be prebaked into the World Build, as I am very skeptical that they have someone who does nothing but vet the VRCUrls baked into worlds that have been recently uploaded, and there's always going to be someone smart enough to outsmart a script.
But a nice compromise would be allowing dynamic URLs which address the site white list which they maintain.
Balphagore
Flir: Agreed. For another compromise is to notify the end user that dynamic URL's are used and they can allow dynamic URL's or uncheck the box if they don't trust data going out.
Scout - VRChat Head of Quality Assurance
tracked
Sayamame
Scout - VRChat Head of Quality Assurance Hi! This canny is already marked as AVAILABLE IN FUTURE RELEASE but not released yet.
Are there any updates? (Sorry for pinging)
Dustuu
Sayamame: My apologies, there was an automation error that mistakenly changed the status of this request. This request is still tracked, but we don't have any updates yet.
Tom Leylan
This by the way is a feature that I would be willing to pay for. I'm not against paying a reasonable monthly fee but if it gets me 100 more avatars or a crown I'm seriously not interested. And if it is abused, as an add-on feature it can be rescinded.