You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Veda content allows the function to be passed as its property with ::js prefix: https://github.com/NASA-IMPACT/veda-ui/blob/main/docs/content/frontmatter/layer.md#function-values . This is mainly used by the mapLabel attribute to create the label dynamically based on the editor’s needs. However, this requires evaluating the function on the fly. Evaluating functions dynamically can pose a security risk. This is particularly dangerous in environments that are less monitored (instances with fewer human resources)
Investigate how MapLabel is currently used in the codebase. Determine whether this function-based approach is actually necessary or if there are alternative ways to achieve the same functionality. Identify and suggest safer alternatives. (ex. Sensible defaults.) or offer some sanitization of functions, at least.
Further - is there any case that uses ::js other than mapLabel?
The text was updated successfully, but these errors were encountered:
hanbyul-here
changed the title
How should we handle mapLabel from the instance?
::js problem - How should we handle mapLabel from the instance?
Feb 3, 2025
Veda content allows the function to be passed as its property with
::js
prefix: https://github.com/NASA-IMPACT/veda-ui/blob/main/docs/content/frontmatter/layer.md#function-values . This is mainly used by the mapLabel attribute to create the label dynamically based on the editor’s needs. However, this requires evaluating the function on the fly. Evaluating functions dynamically can pose a security risk. This is particularly dangerous in environments that are less monitored (instances with fewer human resources)Investigate how MapLabel is currently used in the codebase. Determine whether this function-based approach is actually necessary or if there are alternative ways to achieve the same functionality. Identify and suggest safer alternatives. (ex. Sensible defaults.) or offer some sanitization of functions, at least.
Further - is there any case that uses ::js other than mapLabel?
The text was updated successfully, but these errors were encountered: