Caster icon indicating copy to clipboard operation
Caster copied to clipboard

Secure xmlrpc server/client

Open LexiconCode opened this issue 5 years ago • 0 comments

Is your feature request related to a problem? Please describe. A malicious website targeting Caster users through the browser could execute registered functions via xmlhttprequests on http://localhost:1338.

Describe the solution you'd like To prevent this behavior the RPC server/client needs an authentication token that's randomly generated.

Additional context The impact of this security issue is minimal an attacker could only emulating mouse commands(mouse Grids)/manipulate spec(record from history) blindly and not arbitrary code execution.

This is implemented the dragonfly and could be used for reference https://github.com/dictation-toolbox/dragonfly/pull/61/files#diff-6219d462fba21473f0a2404097943f75R29

LexiconCode avatar May 02 '20 22:05 LexiconCode