Skip to content

All codes

Every validator finding carries a code. This is the full list, by area of the widget.

  • file_missing: error. One of the widget’s four files is missing.
  • file_not_allowed: error. There is a file that is not part of the widget.
  • size_exceeded: error. The widget is too big: 300 KB at most across the four files (and 64 KB for manifest.json).
  • js_syntax: error. There is a syntax error in script.js.
  • js_widget_redeclared: error. You redeclare Widget, which is the SDK.
  • js_forbidden_eval: error. eval and Function are not allowed: they run text as code.
  • js_forbidden_worker: error. Widgets do not use workers: Worker, SharedWorker, WebAssembly, importScripts or navigator.serviceWorker.
  • js_forbidden_network: error. fetch, XMLHttpRequest, WebSocket, EventSource, RTCPeerConnection, StreamerbotClient and navigator.sendBeacon are not allowed: the connection goes only through widget.js.
  • js_forbidden_html: error. innerHTML, outerHTML, srcdoc, insertAdjacentHTML, createContextualFragment, DOMParser and document.write are not allowed: they turn text into HTML.
  • js_forbidden_window_access: error. parent, top, opener, frames and document.cookie are not allowed: the widget does not touch its containing window or its cookies.
  • js_forbidden_navigation: error. open, location.assign and location.replace are not allowed: the widget does not navigate to other pages or open windows.
  • js_storage: warning. localStorage, sessionStorage and indexedDB are not recommended: they fail in the Studio preview and OBS reloads the widget, so stored data does not always survive.
  • js_constructor_escape: error. .constructor is used to escape the widget sandbox.
  • js_dynamic_global_access: error. Globals are accessed dynamically, like window[name].
  • js_event_handler_attribute: error. An on…= attribute is assigned by hand, like element.setAttribute("onclick", …).
  • js_javascript_url: error. A javascript: URL is not allowed.
  • js_external_url: warning. A URL in the code points outside the allowed hosts.