-
Notifications
You must be signed in to change notification settings - Fork 1.7k
style: normalize md files (LF + trim) #12666
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: dev
Are you sure you want to change the base?
Conversation
This pull request includes minor documentation updates related to issue templates and support documentation, with potential information disclosure risks in support and bug report templates, but also includes a positive security improvement in the security issue reporting guidance by directing users to a dedicated security reporting program.
Information Disclosure in Support Requests in
|
Vulnerability | Information Disclosure in Support Requests |
---|---|
Description | Similar to the bug report template, the support request template now instructs users to include docker compose logs, which can potentially expose sensitive system information if not carefully redacted. |
django-DefectDojo/.github/ISSUE_TEMPLATE/support_request.md
Lines 36 to 42 in dc802b7
- Docker Compose or Helm version (Output of `docker compose version` or `helm version`) | |
- DefectDojo version (see footer) or commit message: [use `git show -s --format="[%ci] %h: %s [%d]"`] | |
**Logs** | |
Use `docker compose logs` (or similar, depending on your deployment method) to get the logs and add the relevant sections here showing the error occurring (if applicable). | |
**Sample scan files** |
Credential Delivery Information in docs/content/en/cloud_management/additional-cloud-instance.md
Vulnerability | Credential Delivery Information |
---|---|
Description | Documentation explicitly states that support team will deliver login credentials, which could potentially be leveraged in social engineering attempts by providing insight into the credential delivery process. |
django-DefectDojo/docs/content/en/cloud_management/additional-cloud-instance.md
Lines 42 to 48 in dc802b7
## Step 5: Confirm your Plan type and Billing Frequency | |
At the end of our process, you'll be put in touch with our sales team, who can accurately quote your new server. We recommend you select the Plan Type which has the server specifications you require for the new instance. | |
 | |
Security Issue Reporting Guidance in .github/ISSUE_TEMPLATE/security_issue.md
Vulnerability | Security Issue Reporting Guidance |
---|---|
Description | The security issue template now explicitly directs users to use a dedicated security reporting program instead of GitHub issues. This is a positive security improvement that helps prevent public disclosure of potential vulnerabilities. |
django-DefectDojo/.github/ISSUE_TEMPLATE/security_issue.md
Lines 9 to 15 in dc802b7
**DefectDojo security reporting program** | |
If you believe you have found a **security issue** in DefectDojo, please review the [disclosure policy](../../readme-docs/SECURITY.md) and submit your finding via our security reporting program. | |
Please, do not submit **security issues** via GitHub directly. | |
Information Disclosure in Bug Reports in .github/ISSUE_TEMPLATE/bug_report.md
Vulnerability | Information Disclosure in Bug Reports |
---|---|
Description | The bug report template now instructs users to include logs from docker compose, which can potentially expose sensitive system information. While not a direct code vulnerability, this documentation change could lead to inadvertent information disclosure if users are not careful about redacting sensitive details from logs. |
django-DefectDojo/.github/ISSUE_TEMPLATE/bug_report.md
Lines 36 to 42 in dc802b7
- Docker Compose or Helm version (Output of `docker compose version` or `helm version`) | |
- DefectDojo version (see footer) or commit message: [use `git show -s --format="[%ci] %h: %s [%d]"`] | |
**Logs** | |
Use `docker compose logs` (or similar, depending on your deployment method) to get the logs and add the relevant sections here showing the error occurring (if applicable). | |
**Sample scan files** |
All finding details can be found in the DryRun Security Dashboard.
I've split the formatting changes into separate commits (or PRs) by file type for safer review:
git diff -w
shows empty).md
togetherThis commit only touches 280
md files