search

jsonresume / jsonresume.org

The mono repo that builds the homepage, utils, ui components, registry and anything else
https://jsonresume.org
68 stars 18 forks source link

fix security issues #24

Closed levino closed 9 months ago

levino commented 9 months ago

I think we need to fix all security issues asap. Probably that means removing some or many themes. But the possibility to inject stuff into handlebars templating engine is really problematic, as far as I can tell (just make a resume.json that contains an injection and read out our environment etc.).

levino commented 9 months ago

Some of the security issues are back.

thomasdavis commented 9 months ago

Fixed the criticals

levino commented 9 months ago

We need a way to check on PRs that they do not (re-)introduce vulnerabilities. However I shy away from running a ci script "pnpm audit" for PRs because the exit code of this script might suddenly change for reasons outside of the repository...