Skip to content

Race condition - Date.now() ID collisions in rapid operations #10

Description

@BadAtCaptchas

Description

Layer IDs are generated using Date.now() which only has millisecond precision. Rapid operations (e.g., pasting multiple images, drag-and-drop) can create duplicate IDs.

Affected File

components/canvas-editor.tsx

Current Behavior

id: `layer-paste-${Date.now()}`  // Line ~686
id: `layer-video-${Date.now()}-${i}`  // Line ~979
id: `layer-${Date.now()}-${i}`  // Line ~1060
// ... and many more occurrences

Security Impact

  • Duplicate layer IDs can cause selection/deletion bugs
  • May lead to data corruption in undo/redo history
  • Could cause unpredictable layer manipulation behavior

Suggested Fix

Use a UUID generator or combine timestamp with a random component.

// Example: Use crypto.randomUUID()
id: `layer-paste-${crypto.randomUUID()}`

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions