4 ms·
your login function receives a username and a password from the form, checks them with a network call, and then sends an "user logged" event by calling a functi
by agos 3y ago
your login function receives a username and a password from the form, checks them with a network call, and then sends an "user logged" event by calling a function of a third party library like Google Analytics or Sentry. Now it would be quite dangerous if the code in that function could access the parameters of the original caller which include sensitive data. This gets worse as you consider the entire supply chain of dependencies.
- johncolanduoni 3y agoDoes this really make a practical difference? In your example malicious dependency code could just add a keydown listener on the document to lift a password.