The sandbox works by chance. I should probably make it fail by default. The glTF spec has this to say about URIs:
glTF uses URIs to reference buffers and image resources. Clients must support at least these two URI types:
Data URIs …
Relative URI paths — or
path-noscheme
as defined by RFC 3986, Section 4.2 — without scheme, authority, or parameters. Reserved characters must be percent-encoded, per RFC 3986, Section 2.2.Implementation Note: Clients can optionally support additional URI components. For example
http://
orfile://
schemes, authorities/hostnames, absolute paths, and query or fragment parameters. Assets containing these additional URI components may be less portable.
I’m not sure why the glTF-Validator only flags the issue for GLBs. It should flag it for both.