search

nodejs / security-wg

Node.js Ecosystem Security Working Group
MIT License
497 stars 122 forks source link

Where to report non-core nodejs security bugs? #776

Closed rcowsill closed 2 years ago

rcowsill commented 2 years ago

The HackerOne nodejs program appears to only cover security bugs in Node.js core. When creating a new H1 report the only option for "Asset" is https://github.com/nodejs/node.

Besides core, there are a range of other assets controlled by the Node.js organization: websites, build pipelines and associated infrastructure, for example.

What's the right channel for responsible disclosure of issues in those non-core areas?

DanielRuf commented 2 years ago

It depends, most repos should have a SECURITY.md file like https://github.com/nodejs/docker-node/blob/main/SECURITY.md

rcowsill commented 2 years ago

I can only find three SECURITY.md files across the 120 source repos in the nodejs org:

There are a lot of repos which don't need a policy (eg working groups), but what about repos like:

If there's no listed policy, is it acceptable to report security bugs using issues and submit a PR?

mcollina commented 2 years ago

Never use issues. All repositories in the Node.js github org are in scope for the HackerOne Node.js project.

Trott commented 2 years ago

Never use issues. All repositories in the Node.js github org are in scope for the HackerOne Node.js project.

If I understood @bnb correctly from a conversation we had earlier today, if we put a SECURITY.md file into a repository named .github, then it will show up in the GitHub web interface for all repositories. However, it won't be in the actual checked out code for the repositories. But that might be a good way to get the "HackerOne covers every repository in the org" info out where people will look for it if they are trying to report a bug in undici or nodejs.org or something.

rcowsill commented 2 years ago

Yes, according to this page:

https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file

I think that would be a good solution. It could redirect to the main security policy (or H1), and reinforce the message to never report via issues.

mhdawson commented 2 years ago

PR to add SECURITY.md to the .github repo - https://github.com/nodejs/.github/pull/5

mhdawson commented 2 years ago

The PR landed so closing this now - https://github.com/nodejs/.github/pull/5. Please let us know if that was not the right thing to do.