You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
disable sanitizing if we don't need it in a particular place. We don't need to sanitize local already validated data (like component updater content). We could also add no_sanitize option to APIRequestHelper;
Implement some policy to reuse DataDecoder instances (ask @brave/sec-team). For example, reusing an instance by key = profile + origin looks enough secure;
Do we need to sanitize jsons for Brave controller backend?
Add some metrics to monitor DataDecoder usage;
Stop sanitizing on the startup if possible.
The text was updated successfully, but these errors were encountered:
As was investigated in #30937 we spawn a lot of
DataDecoder
instances.The primary sources are:
APIRequestHelper
(used by number of components)We need:
no_sanitize
option toAPIRequestHelper
;DataDecoder
instances (ask @brave/sec-team). For example, reusing an instance bykey = profile + origin
looks enough secure;The text was updated successfully, but these errors were encountered: