Cw20 logo spec #370
Cw20 logo spec #370
Conversation
packages/cw20/src/logo.rs
Outdated
| #[serde(rename_all = "snake_case")] | ||
| pub enum Logo { | ||
| /// A reference to an externally hosted logo. Must be a valid HTTP or HTTPS URL. | ||
| /// PLEASE REVIEW: is this dangerous from a security point of view? |
There was a problem hiding this comment.
I don't think it is insecure in anyway from blockchain POV - we are not using it internally. The question is if it is possible to use it on external side, and I am not aware about remote execution method using embedded images. And even if it is a case, I think it is webpage who is using this URL responsibility to ensure this image is trusted. My concern is, that keeping images in blockchain/external servers allows abuses with usage of logo, as it is more difficult to moderate this if it lies in blockchain than if it is on owner server, but this relates to both methods of uploading image.
Anyway - whatever final decision is, pleas remember to remove this comment before merging.
packages/cw20/src/msg.rs
Outdated
| /// Setting Some("") will clear this field on the contract storage | ||
| UpdateMarketing { | ||
| /// A URL pointing to the project behind this token. | ||
| /// PLEASE REVIEW: is this dangerous from a security point of view? |
There was a problem hiding this comment.
I would say it is as dangerous as possibility to add your personal page to LinkeIn account - it is just storage, it is user responsibility to responsible internet usage. We could ensure that URL starts with "https", but at the end - if page might not require logging in, why its owner have to use ssh on it?
| /// PLEASE REVIEW: is this dangerous from a security point of view? | ||
| Url(String), | ||
| /// Logo content stored on the blockchain. Enforce maximum size of 5KB on all variants | ||
| Embedded(EmbeddedLogo), |
There was a problem hiding this comment.
Being honest I find this method even more dangerous as passing URL. Someone needs to download the binary image (in particular PNG, SVG is easier to verify) and then display it, but if image is malicious I can imagine that bug in displaying it might be vulnerability - but I would believe, that both <img> and css image embedding is pretty much well tested in modern browsers and should not be dangerous.
Yes, this is just interfaces. The next task #371 is to actually implement them for cw20-base. (And maybe add helpers.rs methods in cw20) |
ethanfrey
force-pushed
the
cw20-logo-spec
branch
from
0ed75c9
to
b4c57c2
Compare
Add a new optional extension to the cw20 spec to allow for managing more marketing-related metadata on-chain. Including links to the projects site as well as token logo.
Please review this if there is more info needed here, to suggest better wording, to point out some security issue, or to comment on DownloadLogoResponse compatibility with React/Vue.