Script dedup key truncation may cause collisions
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- typescript
- Domain
- frontend
Research direction
Start in apps/app/src/components/generative-ui/widget-renderer.tsx at lines 369-370, where executed scripts are tracked with the truncated base64 key. Review the surrounding iframe-bridge logic and verify that distinct script contents receive distinct data attributes. Done means the collision risk is removed without causing already-executed scripts to run again.
Written by the indexing model from the issue text.
Description
Problem
In the widget renderer's iframe bridge (widget-renderer.tsx:369-370), executed scripts are tracked using a truncated base64 key:
```js
content.getAttribute('data-exec-' + btoa(key).slice(0, 16))
```
Truncating to 16 characters creates a collision risk for scripts with similar prefixes. Two different scripts could hash to the same 16-char prefix, causing the second script to be skipped.
Impact
Low probability with current usage (small widget scripts), but could cause bugs if:
- Widgets include multiple scripts with similar content prefixes
- Templates are applied with untrusted or user-influenced content
Suggested fix
Use the full btoa(key) value instead of truncating, or switch to a proper hash function. The data attribute name length is not meaningfully constrained.
Files
apps/app/src/components/generative-ui/widget-renderer.tsx
From PR #20 review
- Dominant language
- TypeScript
- Stars
- 1.6k
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from CopilotKit/OpenGenerativeUI
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
CopilotKit/OpenGenerativeUI#87 · 2 comments ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 5/5 Over a week Newbie friendliness 42/100
All issues in CopilotKit/OpenGenerativeUI
Similar issues
-
clawsweeper:linked-pr-open clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:message-loss issue-rating: 🦞 diamond lobster maturity:stable P2
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#616 ·
-
ZCode 3.14.3 に対応する Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
supermomonga/zcode-acp#24 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
growthbook/growthbook#7100 ·
-
triage
Difficulty 1/5 1-3 hours Newbie friendliness 88/100