Vulnerability Assessment

[alexewerlof]

This issue is an ongoing work and will be completed as I find time to investigate more

This activity assesses the risks of identified threats and deviations in system behavior.

Vulnerabilities

The weaknesses that may be exploited by a threat to create loss.

1. Low performance (eg. hurting response time when used in server code or time to first meaningful paint when used browser side)
2. Out of memory error
3. Crash the application
4. Run unwanted code (if the adversary finds a way to hack/modify the render functions)
5. Access information from outside the scope
6. Change/override the behavior of the lib to affect the rest of the user code.

Threats

1. Malicious templates (including variable names)
2. Malicious resolver functions (developer or third party software)
3. Malicious options that may lead to vulnerability (developer)

Attack vectors

1. The template
2. The scope object
3. The variable values (when using resolve() or get())
4. The resolveFn() and resolveFnAsync() functions