From 59db52035a3bb1ab3df60032b51be9003da383f8 Mon Sep 17 00:00:00 2001 From: Eslam Salem Date: Sun, 10 Apr 2022 23:55:44 +0200 Subject: [PATCH 1/3] Create SECURITY.md Highly inspired by ExpressJS security policy. --- SECURITY.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..a9f38e96 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,20 @@ +# Security Policy +This document outlines security procedures and general policies for the EJS template engine project + +## Supported Versions + +The current supported version. + +| Version | Supported | +| ------- | ------------------ | +| 3.x.x | :white_check_mark: | + +## Reporting a Vulnerability +The EJS team and community take all security bugs in EJS seriously. +We appreciate your efforts and responsible disclosure and will make every effort to acknowledge your contributions. + +Report security bugs by emailing the lead maintainer in the Readme.md file. +To ensure the timely response to your report, please ensure that the entirety of the report is contained within the email body and not solely behind a web link or an attachment. + +The EJS team will then evaluate your report and will reply with the next steps in handling your report and may ask for additional information or guidance. + From c0401802035d154daabe7156e666239102386c57 Mon Sep 17 00:00:00 2001 From: Eslam Salem Date: Wed, 13 Apr 2022 04:46:40 +0200 Subject: [PATCH 2/3] Update README.md Update the readme to add the security note --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 009809c1..0dcb676b 100644 --- a/README.md +++ b/README.md @@ -55,6 +55,9 @@ for all the passed options. However, be aware that your code could break if we add an option with the same name as one of your data object's properties. Therefore, we do not recommend using this shortcut. +### Important +You should never give end-users unfettered access to the EJS render method, If you do so you are using EJS in an inherently un-secure way. + ### Options - `cache` Compiled functions are cached, requires `filename` From 839ad20fd21a32c09463f9ab17f4e3e9ac470ee0 Mon Sep 17 00:00:00 2001 From: Eslam Salem Date: Wed, 13 Apr 2022 04:48:04 +0200 Subject: [PATCH 3/3] Update SECURITY.md --- SECURITY.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index a9f38e96..91756a61 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -18,3 +18,5 @@ To ensure the timely response to your report, please ensure that the entirety of The EJS team will then evaluate your report and will reply with the next steps in handling your report and may ask for additional information or guidance. +## out of scope vulnerabilities +If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that. EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results.