search

mde / ejs

Embedded JavaScript templates -- http://ejs.co
Apache License 2.0
7.7k stars 841 forks source link

Create SECURITY.md #664

Closed netcode closed 2 years ago

netcode commented 2 years ago

Adding a basic security policy. Highly inspired by ExpressJS security policy.

mde commented 2 years ago

Could you please add a statement similar to the following?

"If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that. EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results."

I ask this because we get a ton of supposed security issues that stem from people assuming the render method should be secure. It is not, and nor should it be.

netcode commented 2 years ago

Done, I added this note in the security.md & the readme.md

mde commented 2 years ago

This is awesome, thank you so much!