From 689ca02f029c464e43d3f7bbed7e57c3ee9ac96c Mon Sep 17 00:00:00 2001 From: Matthew Eernisse Date: Mon, 27 Mar 2023 10:36:20 -0700 Subject: [PATCH 1/3] Update SECURITY.md --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 91756a61..35a39f7f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -18,5 +18,5 @@ To ensure the timely response to your report, please ensure that the entirety of The EJS team will then evaluate your report and will reply with the next steps in handling your report and may ask for additional information or guidance. -## out of scope vulnerabilities +## Out-of-Scope Vulnerabilities If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that. EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results. From 828cea1687e3db459ab09d2f405d2444c7580b90 Mon Sep 17 00:00:00 2001 From: Matthew Eernisse Date: Mon, 27 Mar 2023 11:04:07 -0700 Subject: [PATCH 2/3] Update SECURITY.md --- SECURITY.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 35a39f7f..ece64439 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -19,4 +19,14 @@ To ensure the timely response to your report, please ensure that the entirety of The EJS team will then evaluate your report and will reply with the next steps in handling your report and may ask for additional information or guidance. ## Out-of-Scope Vulnerabilities -If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that. EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results. +If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that. + +EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results. + +In short, DO NOT send reports including this snippet of code: + +```javascript +app.get('/', (req, res) => { + res.render('index', req.query); +}); +``` From f47d7aedd51a983e4f73045f962b1209096b5800 Mon Sep 17 00:00:00 2001 From: Matthew Eernisse Date: Mon, 27 Mar 2023 11:04:48 -0700 Subject: [PATCH 3/3] Update SECURITY.md --- SECURITY.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index ece64439..0011b240 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -26,7 +26,17 @@ EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript In short, DO NOT send reports including this snippet of code: ```javascript +const express = require('express'); +const app = express(); +const PORT = 3000; +app.set('views', __dirname); +app.set('view engine', 'ejs'); + app.get('/', (req, res) => { res.render('index', req.query); }); + +app.listen(PORT, ()=> { + console.log(`Server is running on ${PORT}`); +}); ```