Try to load files in root directory when secure is true

lib/loadMtl.js

@@ -217,14 +217,17 @@ function loadMaterialTexture(material, name, texturePath, textureOptions, mtlDir
 
     var texturePromise = texturePromiseMap[texturePath];
     if (!defined(texturePromise)) {
+        var shallowPath = path.resolve(path.join(mtlDirectory, path.basename(texturePath)));
         if (options.secure && outsideDirectory(texturePath, mtlDirectory)) {
+            // Try looking for the texture in the same directory as the obj
+            texturePromise = loadTexture(shallowPath, textureOptions)
+                .catch(function() {
                     options.logger('Could not read texture file at ' + texturePath + ' because it is outside of the mtl directory and the secure flag is true. This texture will be ignored.');
-            texturePromise = Promise.resolve();
+                });
         } else {
             texturePromise = loadTexture(texturePath, textureOptions)
                 .catch(function() {
                     // Try looking for the texture in the same directory as the obj
-                    var shallowPath = path.resolve(path.join(mtlDirectory, path.basename(texturePath)));
                     return loadTexture(shallowPath, textureOptions);
                 })
                 .catch(function() {

lib/loadObj.js

@@ -516,15 +516,21 @@ function loadMtls(mtlPaths, objPath, options) {
     var materials = [];
     return Promise.map(mtlPaths, function(mtlPath) {
         mtlPath = path.resolve(objDirectory, mtlPath);
+        var shallowPath = path.resolve(path.join(objDirectory, path.basename(mtlPath)));
         if (options.secure && outsideDirectory(mtlPath, objDirectory)) {
+            // Try looking for the .mtl in the same directory as the obj
+            return loadMtl(shallowPath, options)
+                .then(function(materialsInMtl) {
+                    materials = materials.concat(materialsInMtl);
+                })
+                .catch(function() {
                     options.logger('Could not read mtl file at ' + mtlPath + ' because it is outside of the obj directory and the secure flag is true. Using default material instead.');
-            return;
+                });
         }
 
         return loadMtl(mtlPath, options)
             .catch(function() {
                 // Try looking for the .mtl in the same directory as the obj
-                var shallowPath = path.resolve(path.join(objDirectory, path.basename(mtlPath)));
                 return loadMtl(shallowPath, options);
             })
             .then(function(materialsInMtl) {

specs/data/box-external-resources-in-root/box-external-resources-in-root.mtl

@@ -0,0 +1,13 @@
+# Blender MTL File: 'box.blend'
+# Material Count: 1
+
+newmtl MaterialTextured
+Ns 96.078431
+Ka 0.000000 0.000000 0.000000
+Kd 0.640000 0.640000 0.640000
+Ks 0.500000 0.500000 0.500000
+Ke 0.000000 0.000000 0.000000
+Ni 1.000000
+d 1.000000
+illum 2
+map_Kd ../box-textured/cesium.png

specs/data/box-external-resources-in-root/box-external-resources-in-root.obj

@@ -0,0 +1,46 @@
+# Blender v2.78 (sub 0) OBJ File: 'box-multiple-materials.blend'
+# www.blender.org
+mtllib box-external-resources-in-root.mtl
+mtllib ../box/box.mtl
+v -1.000000 -1.000000 1.000000
+v -1.000000 1.000000 1.000000
+v -1.000000 -1.000000 -1.000000
+v -1.000000 1.000000 -1.000000
+v 1.000000 -1.000000 1.000000
+v 1.000000 1.000000 1.000000
+v 1.000000 -1.000000 -1.000000
+v 1.000000 1.000000 -1.000000
+vt 0.0000 0.0000
+vt 1.0000 0.0000
+vt 1.0000 1.0000
+vt 0.0000 1.0000
+vt 0.0000 0.0000
+vt 1.0000 0.0000
+vt 1.0000 1.0000
+vt 0.0000 1.0000
+vt 0.0000 0.0000
+vt 1.0000 0.0000
+vt 1.0000 1.0000
+vt 0.0000 1.0000
+vt 0.0000 0.0000
+vt 1.0000 0.0000
+vt 1.0000 1.0000
+vt 0.0000 1.0000
+vt 1.0000 1.0000
+vt 0.0000 1.0000
+vt 0.0000 0.0000
+vt 1.0000 0.0000
+vn 0.0000 -1.0000 0.0000
+vn 0.0000 1.0000 0.0000
+vn -1.0000 0.0000 0.0000
+vn 1.0000 0.0000 0.0000
+vn 0.0000 0.0000 -1.0000
+vn 0.0000 0.0000 1.0000
+usemtl MaterialTextured
+f 3/1/1 7/2/1 5/3/1 1/4/1
+f 1/9/3 2/10/3 4/11/3 3/12/3
+f 3/1/5 4/6/5 8/17/5 7/18/5
+usemtl Material
+f 8/5/2 4/6/2 2/7/2 6/8/2
+f 7/13/4 8/14/4 6/15/4 5/16/4
+f 5/19/6 6/20/6 2/7/6 1/4/6

specs/data/box-external-resources-in-root/box.mtl

@@ -0,0 +1,12 @@
+# Blender MTL File: 'None'
+# Material Count: 1
+
+newmtl Material
+Ns 96.078431
+Ka 0.100000 0.000000 0.000000
+Kd 0.640000 0.640000 0.640000
+Ks 0.500000 0.500000 0.500000
+Ke 0.000000 0.000000 0.100000
+Ni 1.000000
+d 1.000000
+illum 2

specs/lib/loadMtlSpec.js

@@ -14,7 +14,8 @@ var texturedMaterialPath = 'specs/data/box-complex-material/box-complex-material
 var texturedWithOptionsMaterialPath = 'specs/data/box-texture-options/box-texture-options.mtl';
 var multipleMaterialsPath = 'specs/data/box-multiple-materials/box-multiple-materials.mtl';
 var externalMaterialPath = 'specs/data/box-external-resources/box-external-resources.mtl';
-var resourcesInRootPath = 'specs/data/box-resources-in-root/box-resources-in-root.mtl';
+var resourcesInRootMaterialPath = 'specs/data/box-resources-in-root/box-resources-in-root.mtl';
+var externalInRootMaterialPath = 'specs/data/box-external-resources-in-root/box-external-resources-in-root.mtl';
 var transparentMaterialPath = 'specs/data/box-transparent/box-transparent.mtl';
 
 var diffuseTexturePath = 'specs/data/box-textured/cesium.png';
@@ -213,7 +214,19 @@ describe('loadMtl', function() {
     });
 
     it('loads textures from root directory when the texture paths do not exist', function(done) {
-        expect(loadMtl(resourcesInRootPath, options)
+        expect(loadMtl(resourcesInRootMaterialPath, options)
+            .then(function(materials) {
+                var material = materials[0];
+                var baseColorTexture = material.pbrMetallicRoughness.baseColorTexture;
+                expect(baseColorTexture.source).toBeDefined();
+                expect(baseColorTexture.name).toBe('cesium');
+            }), done).toResolve();
+    });
+
+    it('loads textures from root directory when texture is outside of the mtl directory and secure is true', function(done) {
+        options.secure = true;
+
+        expect(loadMtl(externalInRootMaterialPath, options)
             .then(function(materials) {
                 var material = materials[0];
                 var baseColorTexture = material.pbrMetallicRoughness.baseColorTexture;

specs/lib/loadObjSpec.js

@@ -24,6 +24,7 @@ var objMtllibPath = 'specs/data/box-mtllib/box-mtllib.obj';
 var objMissingMtllibPath = 'specs/data/box-missing-mtllib/box-missing-mtllib.obj';
 var objExternalResourcesPath = 'specs/data/box-external-resources/box-external-resources.obj';
 var objResourcesInRootPath = 'specs/data/box-resources-in-root/box-resources-in-root.obj';
+var objExternalResourcesInRootPath = 'specs/data/box-external-resources-in-root/box-external-resources-in-root.obj';
 var objTexturedPath = 'specs/data/box-textured/box-textured.obj';
 var objMissingTexturePath = 'specs/data/box-missing-texture/box-missing-texture.obj';
 var objSubdirectoriesPath = 'specs/data/box-subdirectories/box-textured.obj';
@@ -337,6 +338,22 @@ describe('loadObj', function() {
             }), done).toResolve();
     });
 
+    it('loads .mtl from root directory when the .mtl path is outside of the obj directory and secure is true', function(done) {
+        options.secure = true;
+
+        expect(loadObj(objExternalResourcesInRootPath, options)
+            .then(function(data) {
+                var materials = data.materials;
+                expect(materials.length).toBe(2);
+
+                // .mtl files are loaded in an arbitrary order, so find the "MaterialTextured" material
+                var materialTextured = materials[0].name === 'MaterialTextured' ? materials[0] : materials[1];
+                var baseColorTexture = materialTextured.pbrMetallicRoughness.baseColorTexture;
+                expect(baseColorTexture.source).toBeDefined();
+                expect(baseColorTexture.name).toEqual('cesium');
+            }), done).toResolve();
+    });
+
     it('loads obj with texture', function(done) {
         expect(loadObj(objTexturedPath, options)
             .then(function(data) {