52 lines
2.1 KiB
Markdown
52 lines
2.1 KiB
Markdown
# Security and privacy
|
|
|
|
Patterns, flags, replacement templates, subjects and imported projects are
|
|
untrusted.
|
|
|
|
- Syntax and execution use separate workers.
|
|
- Regex execution never occurs on the UI thread.
|
|
- Timeout, crash and cancellation terminate the worker.
|
|
- A terminated worker is never reused.
|
|
- Pattern, subject, replacement/list template, match, capture and output sizes
|
|
are bounded.
|
|
- Replacement templates are strings; executable callbacks are unavailable.
|
|
- Replacement/list token decorations, rows, chips, diagnostics and list
|
|
evaluation work have separate presentation/operation caps; incomplete list
|
|
results cannot be exported.
|
|
- Per-match replacement mapping executes no user code and is capped at 200
|
|
matches, 2,000 materialized contributions and 50,000 token evaluations.
|
|
- Imported JSON is aggregate-size-bounded before parsing, then field-validated
|
|
and never evaluated or auto-run. Export and IndexedDB save apply the same
|
|
32 MiB aggregate UTF-8 document bound before materialization or persistence.
|
|
- Project and standalone-suite test subjects are not exported by default, and
|
|
unit-test subjects require a separate opt-in before IndexedDB persistence.
|
|
- Unit-test add, update, clone and append-import paths share 1,000-case and
|
|
32 MiB aggregate state caps.
|
|
- Unit-test assertion diagnostics never stringify complete large values and
|
|
retain at most 2 KiB UTF-8 per case. Oversized replacement output is not
|
|
copied into an exact current-result draft.
|
|
- No backend, uploads, telemetry, remote corpus URL, CDN, remote font, `eval`,
|
|
`Function`, arbitrary command line or unsafe HTML rendering exists.
|
|
|
|
Version 0.1.0 needs a CSP equivalent to:
|
|
|
|
```text
|
|
default-src 'self';
|
|
script-src 'self';
|
|
worker-src 'self' blob:;
|
|
connect-src 'self';
|
|
img-src 'self' data:;
|
|
font-src 'self';
|
|
style-src 'self' 'unsafe-inline';
|
|
object-src 'none';
|
|
frame-src 'none';
|
|
base-uri 'none';
|
|
form-action 'none';
|
|
```
|
|
|
|
The Toolbox shell currently requires inline styles. No `unsafe-eval` or
|
|
`wasm-unsafe-eval` is required until an actual WebAssembly flavour ships.
|
|
|
|
Report vulnerabilities privately to the repository owner before public issue
|
|
details are posted.
|