Mitigate Security Risk Protect Global _paq Exposure #119
Description
The _paq variable is currently exposed globally on the window object.
This means any script running in the browser, including malicious ones or browser extensions, can modify or replace _paq. This could lead to altered or lost tracking data, or unauthorized access to tracking events.
Example code overriding _paq:
window._paq = { push: (data) => { // Malicious code } };
Suggested solutions:
- Consider making _paq read-only.
- Use a clone or proxy of _paq internally to prevent external modifications.