Skip to content

[Docs] Correct security guidance and Telegram comment typos #3365

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
roomote-community wants to merge 1 commit into from
Closed

[Docs] Correct security guidance and Telegram comment typos #3365

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/api/src/handlers/telegram/webhook-gate.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ const TELEGRAM_LINK_NUDGE_CHAT_TTL_SECONDS = 15 * 60;
* Rate-limits the group "link your account" nudge so it cannot be used to
* make the bot spam: at most one nudge per sender per chat every 6 hours,
* and at most one nudge per chat every 15 minutes regardless of sender.
* Fails quiet — if Redis is unavailable, no nudge is sent.
* Fails quietly — if Redis is unavailable, no nudge is sent.
*/
export async function claimTelegramLinkNudge(input: {
chatId: string;
Expand Down
2 changes: 1 addition & 1 deletion ...rd/security-best-practices/references/javascript-express-web-server-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -918,7 +918,7 @@ Severity: Medium / Low

NOTE: `npm audit` often returns a large number of insignificant "vulnerabilities" which do not actually matter. You should only focus on Express or other extremely critical packages, ignoring ones listed in dev tools, bundlers, etc.

Do not upgrade packages without concent from the user. This may break existing code in unexpected ways. Instead, inform them of the outdated packages.
Do not upgrade packages without consent from the user. This may break existing code in unexpected ways. Instead, inform them of the outdated packages.

Required:

Expand Down
2 changes: 1 addition & 1 deletion ...d/security-best-practices/references/javascript-jquery-web-frontend-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,7 +156,7 @@ Each rule contains: required practice, insecure patterns, detection hints, and r

Severity: Medium (High if internet-facing app AND version is known-vulnerable)

NOTE: Before performing an upgrade, get concent from the user and try to understand if they have reasons to keep it back. Upgrading can break applications in unexpected ways. Report and recommend upgrades rather than just performing them.
NOTE: Before performing an upgrade, get consent from the user and try to understand if they have reasons to keep it back. Upgrading can break applications in unexpected ways. Report and recommend upgrades rather than just performing them.

Required:

Expand Down
4 changes: 2 additions & 2 deletions ...standard/security-best-practices/references/python-flask-web-server-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,7 +300,7 @@ Severity: Critical
Required:
- MUST NOT render templates that contain user-controlled template syntax.
- MUST treat `render_template_string` and `Environment.from_string(...).render(...)` as dangerous if the template string is influenced by untrusted input.
- MUST NOT use use `.format()` on user controlled strings
- MUST NOT use `.format()` on user controlled strings
- If untrusted templates are absolutely required, treat it as a special high-risk design:
- MUST use a sandboxed templating approach and restrict capabilities.
- MUST keep Jinja updated and assume sandbox escapes are possible; isolate further.
Expand Down Expand Up @@ -702,4 +702,4 @@ Template safety references:
- PortSwigger Web Security Academy: Server-side template injection — https://portswigger.net/web-security/server-side-template-injection

HTTP semantics:
- RFC 9110: HTTP Semantics (safe methods) — https://www.rfc-editor.org/rfc/rfc9110
- RFC 9110: HTTP Semantics (safe methods) — https://www.rfc-editor.org/rfc/rfc9110
Loading