io7m-com / jsycamore

Java embedded GUI package

Home Page:https://www.io7m.com/software/jsycamore

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Users can damage content panes, titlebars, etc

io7m opened this issue · comments

A window's content pane exposes a writable JOTreeNodeType<SyComponentType>. Let's assume that this is necessary because otherwise the user wouldn't be able to add any components to the content pane. The user can now detach the content pane from the window. The user can traverse up the tree and detach the titlebar from the window, etc.

Let's assume that the content pane wasn't directly exposed as a writable JOTreeNodeType but instead allowed the user to add components via an API that hides the tree itself. The individual component types do still expose their own nodes as JOTreeNodeType values, so by getting write access to a single component anywhere, the user can detach or otherwise mess with any other component in the tree.

The tree implementation needs to provide protection against this.