Skip to content

Commit

Permalink
Merge branch 'main' of github.com:mde/ejs into main
Browse files Browse the repository at this point in the history
  • Loading branch information
mde committed May 27, 2023
2 parents 7690404 + f47d7ae commit 11503c7
Showing 1 changed file with 22 additions and 2 deletions.
24 changes: 22 additions & 2 deletions SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,5 +18,25 @@ To ensure the timely response to your report, please ensure that the entirety of

The EJS team will then evaluate your report and will reply with the next steps in handling your report and may ask for additional information or guidance.

## out of scope vulnerabilities
If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that. EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results.
## Out-of-Scope Vulnerabilities
If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that.

EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results.

In short, DO NOT send reports including this snippet of code:

```javascript
const express = require('express');
const app = express();
const PORT = 3000;
app.set('views', __dirname);
app.set('view engine', 'ejs');

app.get('/', (req, res) => {
res.render('index', req.query);
});

app.listen(PORT, ()=> {
console.log(`Server is running on ${PORT}`);
});
```

0 comments on commit 11503c7

Please sign in to comment.