JP2Grok: make grok native vsicurl support opt in

User must set OPJLIKE_VSICURL_NATIVE=YES to opt in, otherwise
GDAL virtual file system is used to read from network.

Author: Grok Compression

frmts/grok/grkdatasetbase.h

@@ -114,14 +114,26 @@ template <size_t N> void safe_strcpy(char (&dest)[N], const std::string &src)
 /**
  * @brief True if @p filename is a network path handled natively by Grok.
  *
- * Both /vsis3/ and /vsicurl/ are fetched via libcurl inside Grok; /vsis3/
- * needs AWS credentials resolved by GDAL, /vsicurl/ only needs the shared
- * HTTP auth options (.netrc, cookies, allow-insecure).
+ * /vsis3/ is always handed to Grok (AWS credentials are resolved by GDAL
+ * before the path reaches Grok).
+ *
+ * /vsicurl/ is only handed to Grok when the user explicitly opts in by
+ * setting the OPJLIKE_VSICURL_NATIVE_OPT config option (or open option) to YES.
+ * Without the flag GDAL reads via curl and streams the bytes to Grok,
+ * which is the safe default.
  */
 static bool isGrokNetworkPath(const char *filename)
 {
-    return STARTS_WITH(filename, "/vsis3/") ||
-           STARTS_WITH(filename, "/vsicurl/");
+    if (STARTS_WITH(filename, "/vsis3/"))
+        return true;
+
+    if (STARTS_WITH(filename, "/vsicurl/"))
+    {
+        return CPLTestBool(
+            CPLGetConfigOption(OPJLIKE_VSICURL_NATIVE_OPT, "NO"));
+    }
+
+    return false;
 }
 
 /**

frmts/opjlike/jp2opjlikedataset.cpp

@@ -1407,6 +1407,11 @@ GDALDataset *JP2OPJLikeDataset<CODEC, BASE>::Open(GDALOpenInfo *poOpenInfo)
     if (!Identify(poOpenInfo) || poOpenInfo->fpL == nullptr)
         return nullptr;
 
+    const char *pszNative = CSLFetchNameValueDef(
+        poOpenInfo->papszOpenOptions, OPJLIKE_VSICURL_NATIVE_OPT, nullptr);
+    if (pszNative)
+        CPLSetThreadLocalConfigOption(OPJLIKE_VSICURL_NATIVE_OPT, pszNative);
+
     /* Detect which codec to use : J2K or JP2 ? */
     vsi_l_offset nCodeStreamLength = 0;
     vsi_l_offset nCodeStreamStart =

frmts/opjlike/jp2opjlikedataset.h

@@ -23,6 +23,15 @@
 #include "gdaljp2abstractdataset.h"
 #include "gdaljp2metadata.h"
 
+/** Environment variable / open option that must be set to YES to let opjlike
+ *  codec handle /vsicurl/ reads natively.
+ *
+ *  Set OPJLIKE_VSICURL_NATIVE=YES as a GDAL config option, or pass it as an
+ *  open option on the dataset, to opt in.
+ */
+static constexpr const char *OPJLIKE_VSICURL_NATIVE_OPT =
+    "OPJLIKE_VSICURL_NATIVE";
+
 typedef int JP2_COLOR_SPACE;
 typedef int JP2_PROG_ORDER;