foreverzer0 / rgss Goto Github PK

Hey,

My name is Maciej Mensfeld and I run a research security project called diffend.io.

I've noticed, that this library downloads some external resources and uses them. While it's a totally common pattern, what is lacking here is integrity verification.

You could verify the integrity of the downloaded file before using it by comparing the file hash to a hardcoded, expected file hash. This is essentially what package managers do to verify the integrity of downloaded packages.

Doing this would prevent attack scenarios in which cglm is manipulated.

Have a great day :)

ref https://my.diffend.io/gems/rgss/0.0.1/page/2#d2h-605472-4332
ref https://gitlab.com/gitlab-org/gitlab/-/issues/291077