Is auto-spellcheck feature disabled by default?

iancoleman / bip39

A web tool for converting BIP39 mnemonic codes

https://iancoleman.io/bip39/

MIT License

3.49k stars 1.44k forks source link

Is auto-spellcheck feature disabled by default? #329

Closed andronoob closed 5 years ago

andronoob commented 5 years ago

Recently, Coinomi was accused for enabling spellcheck feature by mistake: https://www.reddit.com/r/CryptoCurrency/comments/av7gfi/warning_coinomi_wallet_critical_vulnerability/

I wonder is this a security hole? If so, should we fix it?

iancoleman commented 5 years ago

Thanks for reporting this, I really appreciate it.

I'm going to add tags to disable spellcheck as per https://stackoverflow.com/a/254716

Whether this is actually a security hole... I found no indication that spellcheck is ever done via remote services in the browser. Any more info on this would be welcome.

iancoleman commented 5 years ago

See https://github.com/iancoleman/bip39/commit/bea736aeae48b4c17494bed15a987b05206b1486 for fix