rules-webrtc

RISK: Executing eval() on data received from a WebRTC data channel onmessage handler is remote code execution — the remote peer controls the string. FIX: parse messages as structured data (JSON.parse with try/catch) and dispatch based on a validated 'type' field; never pass the raw string to eval or new Function.

RISK: Hardcoded TURN server credentials in RTCPeerConnection iceServers are committed to version control and ship in the client bundle — anyone can extract them to relay arbitrary traffic through your TURN server, causing bandwidth abuse and cost (CWE-798). FIX: fetch short-lived TURN credentials from your server via an authenticated API call immediately before creating the RTCPeerConnection.

ADVISORY: Plain STUN (stun:) leaks the local network topology (LAN IP, NAT type) to the STUN server operator without encryption. For production, use a self-hosted STUN/TURN server or restrict external STUN use; for privacy-sensitive apps consider using a Cloudflare TURN relay that hides the ICE candidates from peers.

ADVISORY: Waiting for all ICE candidates (null event) before signalling is the 'vanilla ICE' pattern — it adds 1-3 seconds of latency and discloses all local interfaces at once. FIX: use Trickle ICE (send each candidate as it arrives via onicecandidate, call addIceCandidate on the remote side) for faster and more privacy-preserving connection setup.

RISK: Passing a remote SDP directly from a WebSocket message or HTTP request body to setRemoteDescription() without validation allows a malicious peer to inject crafted SDP that triggers browser bugs or leaks the local ICE candidates beyond the intended peers. FIX: validate the SDP object shape (type must be 'offer'/'answer', sdp must be a string) and reject unexpected fields before calling setRemoteDescription.

ADVISORY: WebRTC data channels transmit arbitrary binary/text data peer-to-peer without a server intermediary — ensure messages are validated and sanitised before acting on them, as the remote peer is not necessarily trusted.

webkitRTCPeerConnection is a vendor-prefixed legacy API removed in all modern browsers. FIX: use RTCPeerConnection (unprefixed), which has been the standard API since Chrome 56 / Firefox 22 / Safari 11.