Remove minified JavaScript blobs from the plugin and use build system/bundler instead.
Even if it is not a binary blob, it is still significantly harder to perform code review and security auditing.
In case of using minified js: All whitespace, comments, and readable variable names are removed. Malicious code or backdoors can be hidden inside minified payloads with very little chance of being noticed during review, which already happened with xz incident.
Proposed changes:
Do not commit .min.js files or other minified JavaScript blobs to the repository.
If a minified library is needed in, it should be generated/downloaded during the build process (e.g. js bundler or even CI/CD pipeline)
Affected files:
This is a common best practice, and I'm not sure why it isn't done in the first place.
Remove minified JavaScript blobs from the plugin and use build system/bundler instead.
Even if it is not a binary blob, it is still significantly harder to perform code review and security auditing.
In case of using minified js: All whitespace, comments, and readable variable names are removed. Malicious code or backdoors can be hidden inside minified payloads with very little chance of being noticed during review, which already happened with xz incident.
Proposed changes:
Do not commit
.min.jsfiles or other minified JavaScript blobs to the repository.If a minified library is needed in, it should be generated/downloaded during the build process (e.g. js bundler or even CI/CD pipeline)
Affected files:
//#region Protobuf_UMPline)This is a common best practice, and I'm not sure why it isn't done in the first place.