Repository navigation
vulnerability report #1126
Description
Bug Report
I have found a security vulnerability in docsify.sj. How would you like me to report it?
Steps to reproduce
What is current behaviour
What is the expected behaviour
Other relevant information
-
Bug does still occur when all/other plugins are disabled?
-
Your OS:
-
Node.js version:
-
npm/yarn version:
-
Browser version:
-
Docsify version:
-
Docsify plugins:
Activity
anikethsaha commentedon Apr 19, 2020
here only. fill the template and you can submit the report here
Sharifi-Amin commentedon Apr 20, 2020
I would advise against disclosing security vulnerabilities in a public manner before there is fix. please confirm that you want me to disclose details of the vulnerability here. I'll be happy to provide a detailed report and try to help to push a fix as soon as possible .
anikethsaha commentedon Apr 20, 2020
thanks for the alert. no don't report here.
Actually we didn't set up any security policy as of now (I know its bad, I will set up this as soon as possible after discussing with the team ).
and if you want to share some sensitive report ( still I would suggest to reach snyk team first ), mention in the mail and we can discuss there how to do so !
trusktr commentedon Apr 20, 2020
How severe is this issue? Is it in an NPM module that affects local development?
It is hard to imagine any issue with static HTML (markdown) sites being insecure. Docsify sites are purely static by default, with no user information (or did I miss something?).
@anikethsaha Maybe we can make a security issue template, and it can specify contact instructions there.
anikethsaha commentedon Apr 20, 2020
we need to set up a policy here
trusktr commentedon Apr 20, 2020
Ah cool, I didn't know about that.
anikethsaha commentedon Apr 20, 2020
true, but we do support GA, codefund plugins and markdown may contain embedded files so it may be harmful in those cases. not sure though 😅 .
I will still suggest reporting first in snyk for any cases even if it is in our dependencies,
Sharifi-Amin commentedon Apr 20, 2020
I'll get in touch with snyk team asap. I'll contact you through email for a detailed report
Sharifi-Amin commentedon Apr 20, 2020
please let me know if I can contribute in any way
anikethsaha commentedon Apr 20, 2020
great. 👍
contribution of any kind are always welcome. you can share some idea or submit as a policy for better approach. We can discuss there
Sharifi-Amin commentedon Apr 20, 2020
The Snyk team have verified the vulnerability. they will try to get in touch with you to discuss a fix. if you want to close this issue, you can always reach me at amin.sharifi691@gmail.com.
anikethsaha commentedon Apr 20, 2020
Thanks a lot for the reports and responses.
this issue also was a reminder that we need a policy for security reports.
sure.
Thanks 👍
anikethsaha commentedon Apr 20, 2020
I think it's better to keep it open until a response from snyk just to mark it. 👍
Sharifi-Amin commentedon Apr 20, 2020
my pleasure
Sharifi-Amin commentedon Apr 20, 2020
I agree
Koooooo-7 commentedon Apr 21, 2020
I can't imagine the vulnerability in Docsify either.
As a static website, all congratulations can be reached in the browser. including the GA or something stuff(all websites deployed it in same way).
anikethsaha commentedon Apr 21, 2020
I got a mail from
snykand I think we should fix it cause it may be serious. there is a PoC as well. I will share the mail with @docsifyjs/reviewers chat room soon so that we can discuss the fix.Prevent loading remote content via URL hash
fix: Prevent loading remote content via URL hash (#1489)
fix: isExternal check with malformed URL + tests
fix: isExternal check with malformed URL + tests (#1510)