No backend, no database, no network calls. I still found 3 security holes.

No server. No database. No login. No network calls at all. One index.html file, no build step. You open it in a browser, drop in some images, export, done.

So when I sat down to audit it before pushing an update, I figured this would be quick. There's barely anything to attack.

I found three things. None of them were in the rendering code, the canvas code, or anywhere I expected. They were all in the same place: the function that opens a project file.

This is an English write-up of (MIT) if you want to look at the actual diff.

Has anyone found something interesting in their own import path? I'm curious whether the Object.assign one is as common as I suspect.

Vollständiger Original-Bericht

Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.

↗ Original-Artikel auf dev.to lesen