Problem
src/lib/ffmpeg.ts loads the FFmpeg WebAssembly core from a hardcoded
jsDelivr CDN URL with no Subresource Integrity (SRI) check:
const CORE_BASE_URL =
"https://cdn.jsdelivr.net/npm/@ffmpeg/core@0.12.10/dist/umd";
coreURL: await toBlobURL(`${CORE_BASE_URL}/${coreName}.js`, "text/javascript"),
wasmURL: await toBlobURL(`${CORE_BASE_URL}/${coreName}.wasm`, "application/wasm"),toBlobURL fetches the file and re-wraps it as a Blob URL, but does not
verify any cryptographic hash of the fetched content. If jsDelivr is
compromised, or if a man-in-the-middle attack intercepts the fetch (possible
on networks without HSTS), a malicious .js or .wasm file is silently
executed in the user's browser with full access to their files.
Reframe's core value proposition is that files never leave the device. A
compromised WASM payload would silently violate this guarantee.
Impact
- Arbitrary code execution in the user's browser.
- Silent exfiltration of video files the user believed were processed locally.
- Complete violation of the "No uploads. 100% private." privacy guarantee.
Suggested Fix
- Compute SHA-384 hashes of the WASM and JS files for each pinned version:
openssl dgst -sha384 -binary ffmpeg-core.js | openssl base64 -A
- Verify the hash in
toBlobURL or add a manual fetch-and-verify step
before creating the Blob URL.
- Pin the dependency to an exact version (already done:
@0.12.10) and
update the hash whenever the version is bumped.
- Consider bundling the WASM files directly in the project's
public/
directory to eliminate the CDN dependency entirely.
Problem
src/lib/ffmpeg.tsloads the FFmpeg WebAssembly core from a hardcodedjsDelivr CDN URL with no Subresource Integrity (SRI) check:
toBlobURLfetches the file and re-wraps it as a Blob URL, but does notverify any cryptographic hash of the fetched content. If jsDelivr is
compromised, or if a man-in-the-middle attack intercepts the fetch (possible
on networks without HSTS), a malicious
.jsor.wasmfile is silentlyexecuted in the user's browser with full access to their files.
Reframe's core value proposition is that files never leave the device. A
compromised WASM payload would silently violate this guarantee.
Impact
Suggested Fix
toBlobURLor add a manual fetch-and-verify stepbefore creating the Blob URL.
@0.12.10) andupdate the hash whenever the version is bumped.
public/directory to eliminate the CDN dependency entirely.