30 lines
2.5 KiB
Markdown
30 lines
2.5 KiB
Markdown
# Privacy and security
|
|
|
|
## Local processing
|
|
|
|
Diff Tools has no account, telemetry, analytics or application network API. Text and selected files remain in the current browser context. A service worker may cache the published application shell; it does not cache user input or comparison output. Clipboard writes and downloads occur only after an explicit user action.
|
|
|
|
The production CSP permits same-origin scripts and workers and blocks objects, framing and external connections. The release is designed to run below an arbitrary nested path.
|
|
|
|
## Untrusted input
|
|
|
|
- Selected files are checked against the byte limit before strict UTF-8 decoding.
|
|
- All modes enforce character, token/edit, display and output limits. Structured modes add depth, node, row, column, cell and field limits.
|
|
- XML containing DOCTYPE, entity declaration or XInclude syntax is rejected before DOM parsing. A lexical preflight rejects excessive element count or nesting before DOM construction.
|
|
- JSON rejects duplicate keys and the prototype-affecting keys `__proto__`, `prototype` and `constructor`.
|
|
- CSV/TSV fields remain strings; formulas are displayed as text and are not evaluated.
|
|
- Directory hashing rejects traversal, absolute/control-laden and case/Unicode-colliding relative paths. SHA-256 reads use bounded concurrency, file/count/aggregate ceilings and an abort signal.
|
|
- Imported manifests are schema-, path-, digest-, order- and total-validated before comparison. Directory names and digests are sensitive metadata and should be reviewed before sharing.
|
|
- Three-way inputs use the same text ceilings plus an explicit conflict cap; conflict labels have CR/LF removed before entering marker lines.
|
|
- Imported strings are rendered through React text nodes and form controls. No library-generated HTML, imported markup or script is inserted into the document.
|
|
|
|
These controls bound this tool's work; they are not a general-purpose sanitizer and do not make imported data safe for another application.
|
|
|
|
## Availability and cancellation
|
|
|
|
Each comparison normally uses a new module worker. Superseded workers are terminated and stale messages are ignored. A failed comparison leaves the last successful result visible, with the current diagnostic shown separately.
|
|
|
|
## Export considerations
|
|
|
|
Unified patches reflect exact source text, including missing final newline markers. RFC 6902 output is only offered for JSON and preserves decimal lexemes without binary rounding. Portable reports contain bounded source snippets and comparison rows, so users should review them before sharing.
|