Security question

[me21]

Question

Hello,

How secure is NiceGUI library against malicious user? For example, if an input and a button are disabled in Python code, but a user launches browser Developer Tools and manually removes "disabled" attribute from the corresponding controls in the web page, then clicks the button, would Python on_click handler be executed?

[falkoschindler]

Hi @me21,

This specific issue has been addressed in #983 and PR #1030 (version 1.2.21).
But it's always good to keep this attack vector in mind. Maybe there are other situations we haven't taken care of.

[me21]

Regarding that PR, I have a question:

For example, ui.button is a descendant of both Visibility and DisableableElement. How would its is_ignoring_events property work in that case? Would only one version be called, ignoring the other, or both property versions will be ORed together?

[falkoschindler]

I guess they are ORed:

nicegui/nicegui/elements/mixins/disableable_element.py

Lines 18 to 23 in 94cc62c

	@property
	def is_ignoring_events(self) -> bool:
	"""Return whether the element is currently ignoring events."""
	if super().is_ignoring_events:
	return True
	return not self.enabled and self.ignores_events_when_disabled

But if in doubt, we should try it out or write a pytest.