eb66e03f0e
* fix(security): replace new Function() with safe math expression parser Replace the dangerous new Function() constructor in evaluateMathExpression() with a recursive descent parser that safely evaluates basic arithmetic expressions. The Function constructor is a security anti-pattern that could enable arbitrary code execution if the validation regex is ever bypassed or relaxed. The new parser: - Only supports numbers, +, -, *, /, parentheses, and whitespace - Has no eval-like functionality that could execute arbitrary code - Maintains backward compatibility with existing expressions - Handles operator precedence and parentheses correctly Fixes #725 * Apply suggestion from @coderabbitai[bot] Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: Maze <167211895+mazeincoding@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> |
||
|---|---|---|
| .github | ||
| .vscode | ||
| apps | ||
| docs | ||
| legacy | ||
| rust | ||
| script | ||
| .dockerignore | ||
| .gitignore | ||
| .npmrc | ||
| AGENTS.md | ||
| Cargo.lock | ||
| Cargo.toml | ||
| LICENSE | ||
| README.md | ||
| biome.json | ||
| bun.lock | ||
| docker-compose.yml | ||
| package.json | ||
| tsconfig.json | ||
| turbo.json | ||
| wrangler.jsonc | ||
README.md
|
OpenCutA free, open-source video editor for web, desktop, and mobile. |
Sponsors
Thanks to Vercel and fal.ai for their support of open-source software.
Why?
- Privacy: Your videos stay on your device
- Free features: Most basic CapCut features are now paywalled
- Simple: People want editors that are easy to use - CapCut proved that
Features
- Timeline-based editing
- Multi-track support
- Real-time preview
- No watermarks or subscriptions
- Analytics provided by Databuddy, 100% Anonymized & Non-invasive.
- Blog powered by Marble, Headless CMS.
Project Structure
apps/web/– Main Next.js web applicationapps/desktop/– Native desktop app (in progress)src/components/– UI and editor componentssrc/hooks/– Custom React hookssrc/lib/– Utility and API logicsrc/stores/– State management (Zustand, etc.)src/types/– TypeScript types
Getting Started
Prerequisites
- Bun
- Docker and Docker Compose
Note: Docker is optional but recommended for running the local database and Redis. If you only want to work on frontend features, you can skip it.
Setup
-
Fork and clone the repository
-
Copy the environment file:
# Unix/Linux/Mac cp apps/web/.env.example apps/web/.env.local # Windows PowerShell Copy-Item apps/web/.env.example apps/web/.env.local -
Start the database and Redis:
docker compose up -d db redis serverless-redis-http -
Install dependencies and start the dev server:
bun install bun dev:web
The application will be available at http://localhost:3000.
The .env.example has sensible defaults that match the Docker Compose config — it should work out of the box.
Desktop setup
Desktop is opt-in. If you're only working on the web app, skip this entirely.
If you want to get ready for apps/desktop, see apps/desktop/README.md. It's a two-step setup: Rust toolchain first, then desktop native dependencies.
Self-Hosting with Docker
To run everything (including a production build of the app) in Docker:
docker compose up -d
The app will be available at http://localhost:3100.
Contributing
We welcome contributions! While we're actively developing and refactoring certain areas, there are plenty of opportunities to contribute effectively.
🎯 Focus areas: Timeline functionality, project management, performance, bug fixes, and UI improvements outside the preview panel.
⚠️ Avoid for now: Preview panel enhancements (fonts, stickers, effects) and export functionality - we're refactoring these with a new binary rendering approach.
See our Contributing Guide for detailed setup instructions, development guidelines, and complete focus area guidance.
Quick start for contributors:
- Fork the repo and clone locally
- Follow the setup instructions in CONTRIBUTING.md
- Working on
apps/desktop? Seeapps/desktop/README.mdfor setup - Create a feature branch and submit a PR