search

jitsi / libjitsi

Advanced Java media library for secure real-time audio/video communication.
Apache License 2.0
628 stars 281 forks source link

numerous issues identified by lgtm.com/ #527

Open richterdavid opened 4 years ago

richterdavid commented 4 years ago

https://lgtm.com/search?q=jitsi identifies numerous errors in libjitsi and other projects under http://github.com/jitsi. While a number are minor (e.g., no-op variable assignments), others are more concerning, including potential XSS and array index out of bound reads.

Despite the potential disclosure of an XSS, I'm filing this as a normal issue because:

  1. any issues listed are already in the public: anyone can query lgtm.com
  2. jitsi does not have a security policy requesting a different way to submit security issues (https://github.com/jitsi/libjitsi/security)