Spoofing risk via insecure contains/RegEx checks

An additional risk comes from the limited set of assertions supported by the HTTP provider. It currently only supports checking whether a given string is contained in the response or for a RegEx match. This is insufficient to parse HTML data. This may be exploited by an attacker if they are able to partially control some data displayed on the page that Reclaim fetches. For example, a Reclaim data provider for the user's username may be manipulated if the user is able to set their bio, which is also displayed on the same page.

The Reclaim HTTP provider should be updated to support more complex assertions, such as JSON parsing or CSS/XPath selectors.