Skip to content

Conversation

@7amed3li
Copy link

Summary

This PR addresses the security issue reported in #3927 by removing all personal email addresses from source file headers while preserving contributor attributions.

Problem

Security scanners flag exposed developer email addresses in distribution files as a privacy vulnerability (CWE-200: Information Exposure). The current build includes personal emails in @license headers across all dist/ output files.

Solution

Removed email addresses from 13 source files while maintaining:

  • All contributor names and dates
  • GitHub profile/repository links
  • Complete MIT License text
  • Original file formatting (Unix LF line endings)

Changes

Category Files
License src/license.js
Libraries src/libs/rgbcolor.js, omggif.js, WebPDecoder.js
Modules annotations.js, canvas.js, cell.js, context2d.js, fileloading.js, javascript.js, outline.js, total_pages.js, xmp_metadata.js

Verification

# Before: 15+ email matches
grep -rE "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" dist/

# After: Zero matches ✓
grep -rE "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" dist/

@7amed3li 7amed3li force-pushed the fix/security-email-disclosure-3927 branch from 583ff72 to 7bf6685 Compare January 11, 2026 16:17
@7amed3li
Copy link
Author

"Hi @MrRio, I've submitted this PR to resolve the security disclosure issue mentioned in #3927. It's a non-breaking change that only updates license headers. Looking forward to your feedback."

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant