DSH-Arch-Setup/vendor/dsh-ui-translate/SECURITY.md

Security and privacy

Data flow

• The plugin starts disabled.
• The default offline glossary performs no network requests.
• Network-capable translation considers only leaf text approved by a compile-time allowlist of known Chinese DSH UI phrases or narrowly bounded numeric pet templates after applying conservative dynamic-content exclusions.
• The explicitly selected browser-local OPUS-MT backend processes all visible Chinese text, including messages, session/workspace titles, search results, live status text, plugin content, and other user-authored presentation data. This is intentional and remains browser-local.
• Inputs, active composer/contenteditable regions, code/preformatted text, and explicit translate="no" / .notranslate subtrees remain excluded to prevent destructive mutation of authored or executable content.
• Translation mutates only individual Text.data values. The visual highlight and control box do not wrap React-owned nodes, and canonical IDs, links, attributes, and listeners are not changed.
• Translation caches are bounded and memory-only. Model artifacts use the browser's ordinary Cache API and can be removed through browser site-data controls.
• The browser-local backend downloads only pinned public model artifacts from Hugging Face. Source text and model output remain inside a dedicated same-origin Worker. Disabling, reconfiguring, or unloading terminates active inference.
• The OpenAI-compatible backend is opt-in. It receives only allowlisted UI phrases in a JSON array; it does not receive HTML, selectors, URLs, session ids, input values, novel user text, or surrounding page context.

Endpoint controls

• The browser-local Worker and ONNX WebAssembly runtime are served from fixed, same-origin, path-allowlisted Host assets. The Worker downloads the model from a fixed repository and immutable revision; settings cannot replace either identifier.
• The browser calls only the plugin's same-origin Host route for the OpenAI-compatible backend.
• The Host injects an unpredictable per-process token into the served page. Its route accepts JSON POST requests only from a loopback connection with that token, exact same-origin Origin/Host, and Sec-Fetch-Site: same-origin.
• The Host limits request body size, phrase count/length, concurrent requests, and requests per minute before invoking a provider.
• Private and local endpoint names are allowed by default. Public endpoint hosts require an explicit setting and HTTPS.
• URL credentials are rejected. An optional bearer token comes only from a named Host environment variable.
• Provider redirects are rejected.
• Request count, item count, label length, body size, response size, timeout, and caches are bounded.

Residual risk

Remote-provider classification remains conservative: novel user-controlled text cannot be provider input because it is neither in the compile-time source-phrase allowlist nor one of the digit-only templates. Browser-local mode intentionally translates user and session content; any extension or script with access to the same page can already read that DOM, so the plugin's privacy claim is that this text is not sent to a translation server—not that it is hidden from the page itself.

Translated session/workspace names are presentation aliases only. Links and stable IDs remain canonical, so clicking a translated title opens the correct object, but free-text agent commands cannot yet resolve a translated alias back to its source ID. OPUS-MT output can be incorrect, awkward, biased, or offensive and is never authoritative application state. The user can reveal the original or force a re-translation from the visual control box.

To prevent translation of a new subtree, mark its root with translate="no" or class notranslate and report the selector upstream.

Reporting

Please report vulnerabilities privately to the repository owner before opening a public issue. Do not include secrets, page text, or provider credentials in reports.