mckinsey / vizro

Vizro is a toolkit for creating modular data visualization applications.
https://vizro.readthedocs.io/en/stable/
Apache License 2.0
2.46k stars 109 forks source link

[Docs] Add security warning on data manager cache #417

Closed antonymilne closed 2 months ago

antonymilne commented 2 months ago

Description

https://github.com/mckinsey/vizro/pull/398 was merged when it was failing Snyk licence and security checks. I discussed this with @Joseph-Perkins and agreed we should ignore all the warnings but also add a note to our docs - done here.

I've thoroughly read up on the security issue and am not concerned as things stand. So long as dashboard developers use trusted data then all is well. If we ever allow untrusted users to upload data (e.g. through the dashboard) then we'd have to be much more careful though, since potentially that could be a big security risk that allows arbitrary code execution.

So next steps are:

  1. Merge this PR
  2. Ignore the snyk licence issues
  3. Ignore the snyk flask-caching issue

Screenshot

Notice