You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by "raboof (via GitHub)" <gi...@apache.org> on 2023/03/06 15:42:59 UTC
[GitHub] [druid] raboof opened a new pull request, #13886: Document how to report security issues
raboof opened a new pull request, #13886:
URL: https://github.com/apache/druid/pull/13886
### Description
Document how to report security issues on the security overview page, so we can link this page from the homepage. That should make all the other important security information easier to find as well.
Unfortunately I failed to build the site locally to test the change.
<hr>
This PR has:
- [x] been self-reviewed.
- [ ] using the [concurrency checklist](https://github.com/apache/druid/blob/master/dev/code-review/concurrency.md) (Remove this item if the PR doesn't have any relation to concurrency.)
- [x] added documentation for new or modified features or behaviors.
- [ ] a release note entry in the PR description.
- [ ] added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
- [ ] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md)
- [ ] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
- [ ] added unit tests or modified existing tests to cover new code paths, ensuring the threshold for [code coverage](https://github.com/apache/druid/blob/master/dev/code-review/code-coverage.md) is met.
- [ ] added integration tests.
- [ ] been tested in a test Druid cluster.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] paul-rogers commented on pull request #13886: Document how to report security issues
Posted by "paul-rogers (via GitHub)" <gi...@apache.org>.
paul-rogers commented on PR #13886:
URL: https://github.com/apache/druid/pull/13886#issuecomment-1459103438
Our docs checker does not like `mailto` links. Anyone know how to fix this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] vtlim commented on a diff in pull request #13886: Document how to report security issues
Posted by "vtlim (via GitHub)" <gi...@apache.org>.
vtlim commented on code in PR #13886:
URL: https://github.com/apache/druid/pull/13886#discussion_r1128549042
##########
docs/operations/security-overview.md:
##########
@@ -272,3 +272,19 @@ Cluster to deep storage:
Cluster to client:
1. Druid authenticates with the client based on the configured authenticator.
2. Druid only performs actions when an authorizer grants permission. The default configuration is `allowAll authorizer`.
+
+## Reporting security issues
+
+The Apache Druid team takes security very seriously. If you have found a potential security issue in Druid, such as a way to bypass the security mechanisms described above, we encourage you to report this problem at [security@apache.org](mailto:security@apache.org). This is a private mailing list. Please send one plain-text email for each vulnerability you are reporting.
+
+### Vulnerability handling
+
+A summary of the vulnerability handling process is:
+
+* The reporter reports the vulnerability privately to [security@apache.org](mailto:security@apache.org)
+* You will receive a response that we have received the report and will investigate the issue.
Review Comment:
```suggestion
* The reporter receives a response that the Druid team has received the report and will investigate the issue.
```
##########
docs/operations/security-overview.md:
##########
@@ -272,3 +272,19 @@ Cluster to deep storage:
Cluster to client:
1. Druid authenticates with the client based on the configured authenticator.
2. Druid only performs actions when an authorizer grants permission. The default configuration is `allowAll authorizer`.
+
+## Reporting security issues
+
+The Apache Druid team takes security very seriously. If you have found a potential security issue in Druid, such as a way to bypass the security mechanisms described above, we encourage you to report this problem at [security@apache.org](mailto:security@apache.org). This is a private mailing list. Please send one plain-text email for each vulnerability you are reporting.
+
+### Vulnerability handling
+
+A summary of the vulnerability handling process is:
+
+* The reporter reports the vulnerability privately to [security@apache.org](mailto:security@apache.org)
+* You will receive a response that we have received the report and will investigate the issue.
+* The Druid project security team works privately with the reporter to resolve the vulnerability.
+* The Druid project creates a new release of the package the vulnerabilty affects to deliver its fix.
Review Comment:
```suggestion
* The Druid team delivers the fix by creating a new release of the package that the vulnerability affects.
```
##########
docs/operations/security-overview.md:
##########
@@ -272,3 +272,19 @@ Cluster to deep storage:
Cluster to client:
1. Druid authenticates with the client based on the configured authenticator.
2. Druid only performs actions when an authorizer grants permission. The default configuration is `allowAll authorizer`.
+
+## Reporting security issues
+
+The Apache Druid team takes security very seriously. If you have found a potential security issue in Druid, such as a way to bypass the security mechanisms described above, we encourage you to report this problem at [security@apache.org](mailto:security@apache.org). This is a private mailing list. Please send one plain-text email for each vulnerability you are reporting.
Review Comment:
```suggestion
The Apache Druid team takes security very seriously. If you find a potential security issue in Druid, such as a way to bypass the security mechanisms described earlier, please report this problem to [security@apache.org](mailto:security@apache.org). This is a private mailing list. Please send one plain text email for each vulnerability you are reporting.
```
##########
docs/operations/security-overview.md:
##########
@@ -272,3 +272,19 @@ Cluster to deep storage:
Cluster to client:
1. Druid authenticates with the client based on the configured authenticator.
2. Druid only performs actions when an authorizer grants permission. The default configuration is `allowAll authorizer`.
+
+## Reporting security issues
+
+The Apache Druid team takes security very seriously. If you have found a potential security issue in Druid, such as a way to bypass the security mechanisms described above, we encourage you to report this problem at [security@apache.org](mailto:security@apache.org). This is a private mailing list. Please send one plain-text email for each vulnerability you are reporting.
+
+### Vulnerability handling
+
+A summary of the vulnerability handling process is:
+
+* The reporter reports the vulnerability privately to [security@apache.org](mailto:security@apache.org)
+* You will receive a response that we have received the report and will investigate the issue.
+* The Druid project security team works privately with the reporter to resolve the vulnerability.
+* The Druid project creates a new release of the package the vulnerabilty affects to deliver its fix.
+* The Druid project publicly announces the vulnerability and describes how to apply the fix.
Review Comment:
```suggestion
* The Druid team publicly announces the vulnerability and describes how to apply the fix.
```
##########
docs/operations/security-overview.md:
##########
@@ -272,3 +272,19 @@ Cluster to deep storage:
Cluster to client:
1. Druid authenticates with the client based on the configured authenticator.
2. Druid only performs actions when an authorizer grants permission. The default configuration is `allowAll authorizer`.
+
+## Reporting security issues
+
+The Apache Druid team takes security very seriously. If you have found a potential security issue in Druid, such as a way to bypass the security mechanisms described above, we encourage you to report this problem at [security@apache.org](mailto:security@apache.org). This is a private mailing list. Please send one plain-text email for each vulnerability you are reporting.
+
+### Vulnerability handling
+
+A summary of the vulnerability handling process is:
Review Comment:
```suggestion
The following list summarizes the vulnerability handling process:
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] raboof commented on a diff in pull request #13886: Document how to report security issues
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on code in PR #13886:
URL: https://github.com/apache/druid/pull/13886#discussion_r1132623571
##########
docs/operations/security-overview.md:
##########
@@ -272,3 +272,19 @@ Cluster to deep storage:
Cluster to client:
1. Druid authenticates with the client based on the configured authenticator.
2. Druid only performs actions when an authorizer grants permission. The default configuration is `allowAll authorizer`.
+
+## Reporting security issues
+
+The Apache Druid team takes security very seriously. If you find a potential security issue in Druid, such as a way to bypass the security mechanisms described earlier, please report this problem to [security@apache.org](mailto:security@apache.org). This is a private mailing list. Please send one plain text email for each vulnerability you are reporting.
Review Comment:
I'll do you one better: I updated the link check script to skip `mailto:` links and verified with `npm run build` that it correctly creates a mailto link
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] abhishekagarwal87 commented on a diff in pull request #13886: Document how to report security issues
Posted by "abhishekagarwal87 (via GitHub)" <gi...@apache.org>.
abhishekagarwal87 commented on code in PR #13886:
URL: https://github.com/apache/druid/pull/13886#discussion_r1132131919
##########
docs/operations/security-overview.md:
##########
@@ -272,3 +272,19 @@ Cluster to deep storage:
Cluster to client:
1. Druid authenticates with the client based on the configured authenticator.
2. Druid only performs actions when an authorizer grants permission. The default configuration is `allowAll authorizer`.
+
+## Reporting security issues
+
+The Apache Druid team takes security very seriously. If you find a potential security issue in Druid, such as a way to bypass the security mechanisms described earlier, please report this problem to [security@apache.org](mailto:security@apache.org). This is a private mailing list. Please send one plain text email for each vulnerability you are reporting.
Review Comment:
can you remove the link and just put email id as it is? docs checker seem to be failing here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] raboof commented on pull request #13886: Document how to report security issues
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #13886:
URL: https://github.com/apache/druid/pull/13886#issuecomment-1458870308
> Left some suggestions for improving clarity and style.
Great, thanks, applied!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] abhishekagarwal87 merged pull request #13886: Document how to report security issues
Posted by "abhishekagarwal87 (via GitHub)" <gi...@apache.org>.
abhishekagarwal87 merged PR #13886:
URL: https://github.com/apache/druid/pull/13886
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org