24 lines
2.1 KiB
Markdown
24 lines
2.1 KiB
Markdown
# Privacy and security
|
|
|
|
## Data flow
|
|
|
|
Input files are read with the browser File API and decoded as UTF-8. Text is copied to a same-origin worker for parsing and returned as a structured-cloneable model. There is no upload endpoint, account, telemetry, analytics, persistence or content fetch. The service worker only caches the application shell.
|
|
|
|
## Untrusted input controls
|
|
|
|
- Input, model, structural depth, delimited cells, query text/results, previews
|
|
and output have fixed limits. Delimited dimensions are scanned before the
|
|
third-party parser allocates a table, and disposable parses have a 30-second
|
|
deadline.
|
|
- JSON duplicate keys and the keys `__proto__`, `constructor` and `prototype` are rejected.
|
|
- YAML uses the 1.2 core schema with unique string keys, no custom tags or merge keys, and a bounded alias count.
|
|
- XML rejects `DOCTYPE`, entity declarations and XInclude before parsing. The parser is not used to load external resources, and imported markup is never inserted into the DOM.
|
|
- CSV/TSV dynamic typing is disabled. Spreadsheet-safe export prefixes cells beginning with `=`, `+`, `-`, `@`, tab or carriage return; disabling it produces a warning in the conversion report.
|
|
- The safe query language has no evaluator, functions, filters, recursive descent or scripts.
|
|
- Schema inference is capped by sampled nodes/fields and is labelled as inference, not validation.
|
|
- Structural edits use strict JSON Pointer traversal, reject prototype-affecting keys, and cannot bypass the parsed-node/depth ceilings. Lossy source serialization requires a separate acknowledgement.
|
|
|
|
Conversion is not sanitisation. XML-to-object conventions, typed-scalar coercions, nested CSV cell encoding, TOML null handling and unsafe numeric conversions are reported alongside the generated result. Users should inspect that report before relying on converted output.
|
|
|
|
The browser still receives normal application assets from its configured origin. A deployment should retain the supplied restrictive CSP, same-origin worker policy, `nosniff`, no-referrer policy and immutable caching for fingerprinted assets.
|