rules-webgl

RISK: eval() in WebGL code executes arbitrary JavaScript strings. If the string is derived from shader source, URL params, or remote data it becomes a code-injection vector. FIX: compile shaders from static string literals or template tags and never pass user input to eval().

RISK: Reading pixel data with gl.readPixels() and immediately sending it to an external endpoint is a canvas fingerprinting or webcam-frame exfiltration pattern. FIX: ensure readPixels is used only for local in-app rendering (e.g. screenshot, color pick) and never wired directly to a network call that sends the buffer off-device.

RISK: WEBGL_debug_renderer_info exposes the GPU vendor and renderer string — a high-entropy fingerprinting signal browsers restrict post-2019 privacy changes. EXT_disjoint_timer_query enables high-resolution GPU timing side-channels used to fingerprint and de-anonymise users. FIX: remove both extensions from production; use performance.now() for profiling in development only.

RISK: Passing user-controlled strings to gl.shaderSource() and compiling them executes attacker-controlled GPU code — potential driver crashes, DoS, and on some drivers information disclosure via shader side-channels. FIX: keep all GLSL source as static literals or import from .glsl files checked into the repo; never interpolate user data.

RISK: `unsafe-eval` in a Content-Security-Policy allows eval(), new Function(), and inline event handlers in the same page that runs WebGL — it neutralises the XSS defence that CSP provides (CWE-693). FIX: compile shaders at build time and remove unsafe-eval; if a library requires it, consider a compile-time WASM build instead.

ADVISORY: WebGL contexts can be lost due to GPU reset or resource pressure. Without a 'webglcontextlost' listener and context-restore path the page silently goes blank. FIX: listen for 'webglcontextlost' (call event.preventDefault()) and 'webglcontextrestored' to reinitialise buffers and programs.