Caster
Caster copied to clipboard
Secure xmlrpc server/client
Is your feature request related to a problem? Please describe. A malicious website targeting Caster users through the browser could execute registered functions via xmlhttprequests on http://localhost:1338.
Describe the solution you'd like To prevent this behavior the RPC server/client needs an authentication token that's randomly generated.
Additional context The impact of this security issue is minimal an attacker could only emulating mouse commands(mouse Grids)/manipulate spec(record from history) blindly and not arbitrary code execution.
This is implemented the dragonfly and could be used for reference https://github.com/dictation-toolbox/dragonfly/pull/61/files#diff-6219d462fba21473f0a2404097943f75R29