Skip to content

Update security.html to inform about simple-event-sender issues #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update security.html to inform about simple-event-sender issues #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions security.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,11 +46,12 @@
</section>
<section>
<div class="container bg-shade">
<h1 class="section-heading">Repository Name</h1>
<h2 class="section-heading">Report Name</h2>
<h1 class="section-heading">simple-event-sender</h1>
<h2 class="section-heading">Several open security alerts</h2>
<p class="section-paragraph">
<ul>
<li>details</li>
<li>The simple-simple-event sender has several <a href="https://github.com/eiffel-community/simple-event-sender/security/dependabot">high severity security alerts</a>. All users should ensure dependencies are updated.</li>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I get a 404 error for https://github.com/eiffel-community/simple-event-sender/security/dependabot.

Copy link
Contributor Author

@k-hallen-ericsson k-hallen-ericsson Apr 30, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@magnusbaeck well spotted, seems like I have the rights to see that page so I didn't notice. How do we handle that? Should i add a short explanation on the security page? @fredjn

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Even if the link in the PR worked for everyone I'm not sure it be a good fit for this page since it lists current problems (right?) while this page also should cover historical vulnerabilities? Unless we build something very complicated I think this list needs to be maintained by hand.

Copy link
Member

@fredjn fredjn May 3, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I get the 404 as well. Are the alerts still there? I seem to recall I've had access to the alerts page. (But perhaps that was through a screen share in a meeting.) There are a also 2 open issued filed by dependabot on the repository in question. I can't remember if these were related.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably only admin or simlar for the repo that can see it. Ok if I add a short description for now so that we get it published? @fredjn

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From https://github.com/eiffel-community/simple-event-sender/settings/security_analysis

Dependabot and secret scanning alerts are only visible to people and teams that are given access by admins.

I don't think we can link to that page. So instead we need to change this to advise people to update to a certain version of simple-event-sender.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@k-hallen-ericsson , could you make the necessary updates to this PR?

<li>Status: open. Solutions are described in the alert page.</li>
</ul>
</p>
</section>
Expand Down