fix: default frame renderer security improvements #506
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
packages/render/src/ui/index.tsx
Outdated
|
|
||
| // Don't allow SVG data URLs -- could contain malicious code | ||
| if (sanitizedSrc?.startsWith("data:image/svg")) { | ||
| sanitizedSrc = ""; |
There was a problem hiding this comment.
sanitizedSrc is not passed in as src to the img element
packages/render/src/ui/index.tsx
Outdated
| sanitizedSrc?.startsWith("data:") && | ||
| !sanitizedSrc?.startsWith("data:image") | ||
| ) { | ||
| sanitizedSrc = ""; |
There was a problem hiding this comment.
empty string src is invalid afaik - might be better to throw some sort of error on the frame/display an error screen
There was a problem hiding this comment.
replaced with undefined for now. we don't have error handling at this level so will have to refactor
There was a problem hiding this comment.
could maybe move this check to ImageContainer and render an error there or return an error component here
There was a problem hiding this comment.
could maybe move this check to ImageContainer and render an error there or return an error component here
would probably be best, as silent errors is not ideal + neither is logging here
Change Summary
Failing test is unrelated to this PR
Merge Checklist