search

FusionAuth / fusionauth-issues

FusionAuth issue submission project
https://fusionauth.io
91 stars 12 forks source link

vulnerability reported on *.js.map and *.css.map files #2824

Closed konvergence closed 1 month ago

konvergence commented 2 months ago

vulnerability reported on .js.map and .css.map files

Description

Our vulnerability scanner reports vulnerabilities in .js.map and .css.map files. Even on the latest version 1.51.2

fusionauth@fusionauth-webapp-78f5b7d89d-lsz4w:/$ cd /usr/local/fusionauth/
fusionauth@fusionauth-webapp-78f5b7d89d-lsz4w:~$ find . -name "*.map"
./fusionauth-app/web/static/css/fusionauth-style.css.map
./fusionauth-app/web/static/css/theme-editor.css.map
./fusionauth-app/web/static/css/theme-thumbnail.css.map
./fusionauth-app/web/static/css/openlayers-6.6.0.css.map
./fusionauth-app/web/static/css/simple-theme.css.map
./fusionauth-app/web/static/js/openlayers-6.6.0.js.map
./fusionauth-app/web/static/js/prime-min-1.6.1.js.map
./fusionauth-app/web/static/js/prime-min-1.7.0.js.map
./fusionauth-app/web/static/js/prime-min-1.5.3.js.map
./fusionauth-app/web/static/js/prime-min-1.6.4.js.map
./fusionauth-app/web/static/js/prime-min-1.4.1.js.map
./fusionauth-app/web/css/static/fusionauth-style.css.map

Request

is is possible to remove debug map files ?

jobannon commented 2 months ago

@konvergence Thanks for the information. This pages outlines our procedure for reporting vulnerabilities for triage and review. Thanks! https://fusionauth.io/security

konvergence commented 1 month ago

The submitted vulnerability Bugcrowd is 9e94c2e1fe7212e178db653b24955ddd8778e0d0332aabad7df9a5d0a698f11c

robotdan commented 1 month ago

Thanks for letting us know. This will be handled via BugCrowd if there is something we need to change.