Skip to content

Commit

Permalink
Merge branch 'main' of github.com:mde/ejs into main
Browse files Browse the repository at this point in the history
  • Loading branch information
mde committed May 11, 2022
2 parents 551949d + 66f7471 commit 7d5a1c6
Show file tree
Hide file tree
Showing 2 changed files with 25 additions and 0 deletions.
3 changes: 3 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,9 @@ for all the passed options. However, be aware that your code could break if we
add an option with the same name as one of your data object's properties.
Therefore, we do not recommend using this shortcut.

### Important
You should never give end-users unfettered access to the EJS render method, If you do so you are using EJS in an inherently un-secure way.

### Options

- `cache` Compiled functions are cached, requires `filename`
Expand Down
22 changes: 22 additions & 0 deletions SECURITY.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# Security Policy
This document outlines security procedures and general policies for the EJS template engine project

## Supported Versions

The current supported version.

| Version | Supported |
| ------- | ------------------ |
| 3.x.x | :white_check_mark: |

## Reporting a Vulnerability
The EJS team and community take all security bugs in EJS seriously.
We appreciate your efforts and responsible disclosure and will make every effort to acknowledge your contributions.

Report security bugs by emailing the lead maintainer in the Readme.md file.
To ensure the timely response to your report, please ensure that the entirety of the report is contained within the email body and not solely behind a web link or an attachment.

The EJS team will then evaluate your report and will reply with the next steps in handling your report and may ask for additional information or guidance.

## out of scope vulnerabilities
If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that. EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results.

0 comments on commit 7d5a1c6

Please sign in to comment.