Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add security warning for ambiguous source maps #137

Merged
merged 3 commits into from
Oct 10, 2024
Merged

Add security warning for ambiguous source maps #137

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
00f765e
Add security notice warning for ambiguous source maps
nicolo-ribaudo Oct 10, 2024
92fe9d6
typo
nicolo-ribaudo Oct 10, 2024
daa9c8c
Other typo
nicolo-ribaudo Oct 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions source-map.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -777,6 +777,19 @@ without parsing|without parsing=] gives `foo.js.map`.

</div>

<div class="issue">
Having multiple ways to extract a source map URL, that can lead to different
results, can have negative security and privacy implications. Implementations
that need to detect which source maps are potentially going to be loaded are
strongly encouraged to always apply both algorithms, rather than just assuming
that they will give the same result.

A fix to this problem is being worked on, and will likely involve early returning
from the below algorithms whenever there is a comment (or comment-like) that
contains the characters U+0060 (&#x60;), U+0022 ("), or U+0027 ('), or the the
sequence U+002A U+002F (*/).
</div>

#### Extraction methods for JavaScript sources #### {#extraction-javascript}

To <dfn export>extract a Source Map URL from JavaScript through parsing</dfn> a [=string=] |source|,
Expand Down
Loading