Open
Description
The _code_samples/escrow/js/
folder has several issues:
- the
package.json
requires both xrpl.js 3.0 and ripple-lib 0.17 (the latter is ancient and unused in the code). It's likely thatripple-lib
is the source of the security issue flagged in chore: upgrade realm version and migrate deprecated config #2783. - the samples use the
if (typeof module !== "undefined")
hack, which is intended to make the same code run in both a browser via html file and in node.js, but they don't have a demo HTML file - The samples use hard-coded secrets instead of using the faucet
- The existing tutorials like Send a Time-Held Escrow use WebSocket requests for sign-and-submit (insecure unless you know what you're doing) instead of signing using the client library