Warzone Joker Limner
Acrylic, pencil and marker on canvas
12.03.2026 08:40
👍 164
🔁 36
💬 0
📌 0
Warzone Joker Limner
Acrylic, pencil and marker on canvas
A drawing of a dragon, claws up, on thin brown paper with glowing amber eyes.
The backside of the object showing the 9v battery powering it, the bodged circuit, leads puncturing and suspending the paper, and plastic and metal enclosures focusing the amber light.
glowing eyes idea
haiku
after Kaoru Fujiwara
memory
snorf snof
you're welcome 🤗
The art, and the artist
art I made for @aurawolfie.bsky.social ✨🌊!!!
Portrait of my reflection in the window
good read 10/10 🏆
A chubby wooden kitty looking content, arms resting on his belly
I hope his peace is contagious
a thief in the paint
if a gamma ray burst type event happened I would simply dodge. not worried about it
cawm
BB is peak 🎩
Do it now
One clarification: While the vulnerability is present regardless of Server Actions, it technically leverages Server Functions, which is a shared component in RSC's architecture.
It was the fact that other RSC features relied on Server Functions that led to every RSC app having a vulnerable endpoint
Ultimately, what you will need to check varies on the framework and architecture of your app. Different frameworks have different patterns, some more idiomatic, some with more sharp edges, but all very new and unfamiliar to most engineers.
So just like in any backend scenario handling untrusted input, you would perform validation and other checks, inside of that server action function.
My personal opinion is that exactly what validation needs to be performed in your average React app with a Server Action, can be extremely unclear.
To answer your question about the security boundary of Server Actions: The action has to be in a file marked with the directive 'use server' which indicates it will execute on the server. The client calls the function with the arguments from a separate file. These arguments are untrusted input.
From a dev's perspective, those are React Server Actions. Generally, most apps built in React use a mix of client and server components, with the latter benefitting from features like streaming, which use the deserializer. This vulnerability would have been present regardless of Server Actions.
Technically, you do not need to traverse to a then-able promise. There are other vectors as well susceptible to the same lack of guard check.
The irony of it all is that the guard check was actually imported into the file but then never used in the code. Oops! 🫨
