search

ProtonMail / WebClients

Monorepo hosting the proton web clients
GNU General Public License v3.0
4.27k stars 545 forks source link

WebApp as of Version 4.0.18 Contains Source Maps #269

Closed gilmorem560 closed 2 years ago

gilmorem560 commented 2 years ago

Reported this via the application itself but figured I'd toss the info here too just in case it is relevant or a problem. I found today that if I navigate to the Debugger tab in Firefox Dev Tools, I can see the full mapped source of the webapp. Given that it is open-source here, I'm not sure how much of a problem this actually presents, but I just know as a developer myself, that isn't typically something I include in production deployments, so wanted to make folks aware just in case this isn't known. If it's by design then disregard.

kylekatarnls commented 2 years ago

Front source code is completely transparent and not aimed to be obfuscated.

Source map are here to help any searcher willing to to check how it works.

As a general note for any project, code obfuscation is not providing any kind of security anyway, it's still quite easy for an attacker to find breaches or understand the minified code with just a few more efforts. Actually an attacker wouldn't even need to know anything about your front for many kinds of attacks that just directly target server APIs.

As source maps are lazy-loaded, they have no impact neither on the page loading speed.

gilmorem560 commented 2 years ago

Oh yeah, no concerns if it is by design, I just saw that in passing and thought it was particularly odd, but if things are locked down tight they're locked down tight. Thanks for the feedback!