Add 3MF post-processing script checks

Author: mbv06

CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+## v0.1.2 - 2026-05-20
+
+### Added
+
+- Add optional 3MF post-processing script checks. By default, the bridge notifies the user, writes the script text to the log, and then continues opening the file.
+
+### Fixed
+
+- Ignore empty `bambustudioopen` URI launches without showing an error or running the download flow.
+- Improve diagnostics for malformed slicer links by logging the original input URI when URL extraction fails.
+
+## v0.1.1 - 2026-04-28
+
+### Added
+
+- Add an automatic Windows installer that sets up the bridge and registers URI handlers.
+- Add `python -m slicer_uri_bridge` support as a fallback way to run the CLI when the script entry point is not on `PATH`.
+
+## v0.1.0 - 2026-04-28
+
+### Initial Release
+
+- Add the first Slicer URI Bridge CLI for routing slicer links to Bambu Studio.
+- Support Bambu Studio, PrusaSlicer, OrcaSlicer, Cura, and Creality Print style URI links.
+- Add safe model download validation before opening files in Bambu Studio.
+- Add interactive URI handler registration and status management.
+- Add an automatic macOS installer.

README.md

@@ -135,9 +135,12 @@ The bridge validates downloads before opening them:
 * redirect targets are revalidated
 * downloaded files must use an allowed model extension
 * empty files and obvious executable formats are refused
+* 3MF files are checked for embedded post-processing scripts ([scripts that can run after slicing](https://manual.slic3r.org/advanced/post-processing))
 
 By default, downloads are accepted from any host. To restrict downloads to specific hosts, set `allow_any_original_host = false` in the config and use the `allowed_hosts` list (the default config includes CDNs for Printables, Thingiverse, and Creality).
 
+All available options are described in the bundled [`default_config.toml`](src/slicer_uri_bridge/resources/default_config.toml) template and copied into the generated `config.toml` file.
+
 ## Troubleshooting
 
 The bridge writes log files next to the config file. To find their location:

src/slicer_uri_bridge/handler.py

@@ -3,6 +3,7 @@
 
 import argparse
 import ipaddress
+import json
 import logging
 import posixpath
 import re
@@ -17,6 +18,7 @@
 import urllib.parse
 import urllib.request
 import urllib.response
+import zipfile
 from pathlib import Path, PurePosixPath, PureWindowsPath
 from urllib.parse import urlsplit
 
@@ -34,6 +36,9 @@
 BUFFER_SIZE = 81920
 REDIRECT_CODES = {301, 302, 303, 307, 308}
 EXECUTABLE_MODE_BITS = stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH
+PROJECT_SETTINGS_PATH = "Metadata/project_settings.config"
+POST_PROCESS_ACTION_DEFAULT = "warn"
+POST_PROCESS_ACTIONS = {"ignore", "warn", "block"}
 
 
 class BridgeError(RuntimeError):
@@ -80,7 +85,18 @@ def is_host(value: str) -> bool:
         return bool(p.hostname) and not any((p.scheme, p.path, p.query, p.fragment, p.username, p.password))
     except ValueError:
         return False
-    
+
+
+def normalize_post_process_action(value: object) -> str:
+    if isinstance(value, str):
+        action = value.strip().lower()
+        if action in POST_PROCESS_ACTIONS:
+            return action
+
+    logger.warning("Invalid security.post_process_action; using warn")
+    return POST_PROCESS_ACTION_DEFAULT
+
+
 def load_config() -> dict:
     if not CONFIG_FILE.is_file():
         raise BridgeError(missing_config_message(CONFIG_FILE))
@@ -106,6 +122,8 @@ def load_config() -> dict:
         logger.warning("Invalid security.allow_any_original_host; using false")
         security["allow_any_original_host"] = False
 
+    security["post_process_action"] = normalize_post_process_action(security.get("post_process_action"))
+
     allowed_hosts = security.get("allowed_hosts", [])
     valid_hosts = []
     if isinstance(allowed_hosts, list):
@@ -513,6 +531,55 @@ def validate_downloaded_file(path: Path) -> None:
         raise BridgeError("Downloaded file is a Mach-O executable, refusing to open it.")
 
 
+def scan_3mf_post_process(path: Path) -> list[str] | None:
+    if path.suffix.lower() != ".3mf":
+        return None
+
+    try:
+        with zipfile.ZipFile(path) as archive:
+            settings = json.loads(archive.read(PROJECT_SETTINGS_PATH).decode("utf-8-sig"))
+            if isinstance(raw := settings.get("post_process"), list):
+                return raw or None
+    except Exception as exc:
+        logger.warning("Could not inspect 3MF project settings in %s: %s", path, exc)
+
+    return None
+
+
+def post_process_message(path: Path, commands: list[str]) -> str:
+    if len(commands) == 1:
+        post_process = commands[0]
+    else:
+        post_process = "\n\n".join(
+            f"[{index}]\n{command}" for index, command in enumerate(commands, start=1)
+        )
+
+    return (
+        "Downloaded 3MF file contains a post-processing script.\n\n"
+        f"File: {path}\n\n"
+        "post_process:\n"
+        f"{post_process}"
+    )
+
+
+def check_3mf_post_process(path: Path, action: str) -> None:
+    if action == "ignore":
+        return
+
+    commands = scan_3mf_post_process(path)
+    # No real commands if every value becomes empty after trimming whitespace.
+    if commands is None or not any(command.strip() for command in commands):
+        return
+
+    message = post_process_message(path, commands)
+    logger.warning("%s", message)
+
+    if action == "block":
+        raise BridgeError(message)
+
+    show_warning(message)
+
+
 def has_executable_bits(mode: int) -> bool:
     if IS_WINDOWS:
         return False
@@ -601,20 +668,28 @@ def launch_bambu(command: list[str], model_path: Path) -> None:
         raise BridgeError(f"Failed to start Bambu Studio: {exc}") from exc
 
 
-def show_error(message: str) -> None:
+def show_message(message: str, kind: str) -> None:
     print(message, file=sys.stderr)
     try:
         import tkinter
         from tkinter import messagebox
 
         root = tkinter.Tk()
         root.withdraw()
-        messagebox.showerror("Bambu Studio URI Bridge", message)
+        getattr(messagebox, kind)("Slicer URI Bridge", message)
         root.destroy()
     except Exception:
         pass
 
 
+def show_error(message: str) -> None:
+    show_message(message, "showerror")
+
+
+def show_warning(message: str) -> None:
+    show_message(message, "showwarning")
+
+
 def main(argv: list[str] | None = None) -> int:
     setup_logging()
     args = parse_args(sys.argv[1:] if argv is None else argv)
@@ -661,6 +736,7 @@ def main(argv: list[str] | None = None) -> int:
             allow_plain_http=allow_plain_http,
         )
         validate_downloaded_file(local_path)
+        check_3mf_post_process(local_path, security["post_process_action"])
 
         launch_bambu(command, local_path)
 

src/slicer_uri_bridge/resources/default_config.toml

@@ -4,6 +4,9 @@
 allow_plain_http = false
 allow_any_original_host = true
 allowed_extensions = [".3mf", ".stl", ".step", ".stp", ".obj"]
+# 3MF files can contain Bambu/Orca post-processing commands.
+# Values: "ignore", "warn" (show a warning and open), or "block" (refuse to open).
+post_process_action = "warn"
 # allowed_hosts is only used when allow_any_original_host = false
 allowed_hosts = [
   "files.printables.com",

tests/test_handler.py

@@ -1,9 +1,11 @@
 from __future__ import annotations
 
+import json
 import shutil
 import subprocess
 import unittest
 import uuid
+import zipfile
 from collections.abc import Iterator
 from contextlib import contextmanager
 from pathlib import Path
@@ -12,15 +14,19 @@
 from slicer_uri_bridge.handler import (
     BridgeError,
     build_destination,
+    check_3mf_post_process,
     choose_filename,
     extract_download,
     filename_from_url,
+    load_config,
     is_empty_bambustudioopen_uri,
     normalize_host,
+    normalize_post_process_action,
     main,
     read_protocol_uri,
     has_executable_bits,
     launch_bambu,
+    scan_3mf_post_process,
     validate_downloaded_file,
     validate_remote_url,
 )
@@ -40,6 +46,11 @@ def temporary_directory() -> Iterator[str]:
         shutil.rmtree(path, ignore_errors=True)
 
 
+def write_3mf(path: Path, project_settings: object, *, member: str = "Metadata/project_settings.config") -> None:
+    with zipfile.ZipFile(path, "w") as archive:
+        archive.writestr(member, json.dumps(project_settings))
+
+
 class DownloadUriTests(unittest.TestCase):
     def test_bambu_uri_decodes_payload_and_strips_model_slash(self) -> None:
         url, suggested_name = extract_download(
@@ -282,6 +293,117 @@ def test_has_executable_bits_is_disabled_on_windows(self) -> None:
             self.assertFalse(has_executable_bits(0o100755))
 
 
+class ThreeMfPostProcessTests(unittest.TestCase):
+    def test_scan_3mf_post_process_detects_project_setting(self) -> None:
+        script = r"C:\Users\maker\inspect_model.ps1"
+        with temporary_directory() as temp_dir:
+            path = Path(temp_dir) / "model.3mf"
+            write_3mf(path, {"post_process": [script]})
+
+            result = scan_3mf_post_process(path)
+
+        self.assertEqual(result, [script])
+
+    def test_check_3mf_post_process_ignores_blank_values(self) -> None:
+        with temporary_directory() as temp_dir:
+            path = Path(temp_dir) / "model.3mf"
+            write_3mf(path, {"post_process": ["", "   "]})
+
+            with patch("slicer_uri_bridge.handler.show_warning") as show_warning:
+                check_3mf_post_process(path, "warn")
+
+        show_warning.assert_not_called()
+
+    def test_check_3mf_post_process_warns_and_allows(self) -> None:
+        script = r"C:\Users\maker\inspect_model.ps1"
+        with temporary_directory() as temp_dir:
+            path = Path(temp_dir) / "model.3mf"
+            write_3mf(path, {"post_process": [script]})
+
+            with (
+                patch("slicer_uri_bridge.handler.show_warning") as show_warning,
+                self.assertLogs("slicer_uri_bridge", level="WARNING") as captured,
+            ):
+                check_3mf_post_process(path, "warn")
+
+        show_warning.assert_called_once()
+        self.assertIn(script, show_warning.call_args.args[0])
+        self.assertTrue(any(script in line for line in captured.output))
+
+    def test_check_3mf_post_process_blocks_when_configured(self) -> None:
+        with temporary_directory() as temp_dir:
+            path = Path(temp_dir) / "model.3mf"
+            write_3mf(path, {"post_process": [r"C:\Users\maker\inspect_model.ps1"]})
+
+            with self.assertRaisesRegex(BridgeError, "post-processing script"):
+                check_3mf_post_process(path, "block")
+
+    def test_main_does_not_launch_bambu_when_post_process_is_blocked(self) -> None:
+        script = r"C:\Users\maker\inspect_model.ps1"
+        config = {
+            "security": {
+                "allowed_extensions": [".3mf"],
+                "allow_plain_http": False,
+                "allowed_hosts": [],
+                "allow_any_original_host": True,
+                "post_process_action": "block",
+            },
+            "bambu_studio": {},
+        }
+
+        with temporary_directory() as temp_dir:
+            path = Path(temp_dir) / "model.3mf"
+            write_3mf(path, {"post_process": [script]})
+
+            with (
+                patch("slicer_uri_bridge.handler.load_config", return_value=config),
+                patch("slicer_uri_bridge.handler.validate_remote_url"),
+                patch("slicer_uri_bridge.handler.resolve_bambu_command", return_value=["bambu-studio"]),
+                patch("slicer_uri_bridge.handler.download_model", return_value=path),
+                patch("slicer_uri_bridge.handler.launch_bambu") as launch,
+                patch("slicer_uri_bridge.handler.show_error") as show_error,
+            ):
+                exit_code = main(["bambustudioopen://https%3A%2F%2Ffiles.example%2Fmodel.3mf"])
+
+        self.assertEqual(exit_code, 1)
+        launch.assert_not_called()
+        show_error.assert_called_once()
+        self.assertIn(script, show_error.call_args.args[0])
+
+    def test_check_3mf_post_process_ignore_skips_archive_inspection(self) -> None:
+        with temporary_directory() as temp_dir:
+            path = Path(temp_dir) / "model.3mf"
+            path.write_bytes(b"not a zip")
+
+            with patch("slicer_uri_bridge.handler.zipfile.ZipFile") as zip_file:
+                check_3mf_post_process(path, "ignore")
+
+        zip_file.assert_not_called()
+
+    def test_post_process_action_defaults_to_warn_for_invalid_values(self) -> None:
+        self.assertEqual(normalize_post_process_action(None), "warn")
+        self.assertEqual(normalize_post_process_action("block"), "block")
+        self.assertEqual(normalize_post_process_action("off"), "warn")
+
+    def test_load_config_defaults_post_process_action_to_warn(self) -> None:
+        with temporary_directory() as temp_dir:
+            config_path = Path(temp_dir) / "config.toml"
+            config_path.write_text("""\
+[security]
+allow_any_original_host = true
+allowed_extensions = [".3mf"]
+
+[bambu_studio]
+""",
+                encoding="utf-8",
+            )
+
+            with patch("slicer_uri_bridge.handler.CONFIG_FILE", config_path):
+                config = load_config()
+
+        self.assertEqual(config["security"]["post_process_action"], "warn")
+
+
 class ProtocolFileTests(unittest.TestCase):
     def test_read_protocol_uri_decodes_bom_and_removes_temp_file(self) -> None:
         with temporary_directory() as temp_dir: