omg yayy!! so happy to see youre back in japan again!!

Warzone Joker Limner

Acrylic, pencil and marker on canvas

A drawing of a dragon, claws up, on thin brown paper with glowing amber eyes.

The backside of the object showing the 9v battery powering it, the bodged circuit, leads puncturing and suspending the paper, and plastic and metal enclosures focusing the amber light.

glowing eyes idea

haiku

after Kaoru Fujiwara

memory

snorf snof

you're welcome 🤗

The art, and the artist

art I made for @aurawolfie.bsky.social ✨🌊!!!

Portrait of my reflection in the window

good read 10/10 🏆

A chubby wooden kitty looking content, arms resting on his belly

I hope his peace is contagious

a thief in the paint

if a gamma ray burst type event happened I would simply dodge. not worried about it

cawm

Storm Show YouTube video by Oneohtrix Point Never - Topic

youtu.be/hCbwx2hA5mM

BB is peak 🎩

Do it now

One clarification: While the vulnerability is present regardless of Server Actions, it technically leverages Server Functions, which is a shared component in RSC's architecture.

It was the fact that other RSC features relied on Server Functions that led to every RSC app having a vulnerable endpoint

Ultimately, what you will need to check varies on the framework and architecture of your app. Different frameworks have different patterns, some more idiomatic, some with more sharp edges, but all very new and unfamiliar to most engineers.

So just like in any backend scenario handling untrusted input, you would perform validation and other checks, inside of that server action function.

My personal opinion is that exactly what validation needs to be performed in your average React app with a Server Action, can be extremely unclear.

To answer your question about the security boundary of Server Actions: The action has to be in a file marked with the directive 'use server' which indicates it will execute on the server. The client calls the function with the arguments from a separate file. These arguments are untrusted input.

From a dev's perspective, those are React Server Actions. Generally, most apps built in React use a mix of client and server components, with the latter benefitting from features like streaming, which use the deserializer. This vulnerability would have been present regardless of Server Actions.