ティント

The art, and the artist

art I made for @aurawolfie.bsky.social ✨🌊!!!

Portrait of my reflection in the window

Fursona Avocado is photographed with a flash in the darkness. It stares into the camera. There is some dust floating around out of focus.

good read 10/10 🏆

A chubby wooden kitty looking content, arms resting on his belly

I hope his peace is contagious

a thief in the paint

if a gamma ray burst type event happened I would simply dodge. not worried about it

cawm

YouTube video by Oneohtrix Point Never - Topic Storm Show

youtu.be/hCbwx2hA5mM

BB is peak 🎩

Do it now

One clarification: While the vulnerability is present regardless of Server Actions, it technically leverages Server Functions, which is a shared component in RSC's architecture.

It was the fact that other RSC features relied on Server Functions that led to every RSC app having a vulnerable endpoint

Ultimately, what you will need to check varies on the framework and architecture of your app. Different frameworks have different patterns, some more idiomatic, some with more sharp edges, but all very new and unfamiliar to most engineers.

So just like in any backend scenario handling untrusted input, you would perform validation and other checks, inside of that server action function.

My personal opinion is that exactly what validation needs to be performed in your average React app with a Server Action, can be extremely unclear.

To answer your question about the security boundary of Server Actions: The action has to be in a file marked with the directive 'use server' which indicates it will execute on the server. The client calls the function with the arguments from a separate file. These arguments are untrusted input.

From a dev's perspective, those are React Server Actions. Generally, most apps built in React use a mix of client and server components, with the latter benefitting from features like streaming, which use the deserializer. This vulnerability would have been present regardless of Server Actions.

Technically, you do not need to traverse to a then-able promise. There are other vectors as well susceptible to the same lack of guard check.

The irony of it all is that the guard check was actually imported into the file but then never used in the code. Oops! 🫨

The deserializer in Flight, React's protocol for client/server communication, was missing a guard check. This allowed attackers to craft and send a malicious "chunk" object that allows for prototype pollution, ultimately resulting in a call to a then-able promise that will execute code.

and the world is richer for it 😌

charging for a bit

commission for @phira.bsky.social

Hi

one of the all time songs. my soul is tuning in every time it plays.

skeb thanksでした！

Seasons Are Changing.