jzonthemtn commented on code in PR #1198: URL: https://github.com/apache/opennlp/pull/1198#discussion_r3668331026
########## SECURITY.md: ########## @@ -0,0 +1,232 @@ +<!-- +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +--> + +# Security Policy and Security Model + +## Reporting a Vulnerability + +**Please do not report security issues through GitHub, the mailing lists, or any +other public channel.** + +Report suspected vulnerabilities privately to the Apache Security Team at +[[email protected]](mailto:[email protected]). The team will forward the +report to the Apache OpenNLP PMC and coordinate the response with you. See the +[ASF security process](https://www.apache.org/security/) for what to expect. + +When reporting, it helps a great deal if you can tell us which of the trust +boundaries described below your finding crosses, and what an attacker controls in +your scenario. + +## Supported Versions + +Security fixes are made to the most recent release of the 2.x line and to the +current 3.x line. Apache OpenNLP 1.x is end of life and receives no fixes; users +still on 1.x should upgrade. + +## Security Model + +### What Apache OpenNLP is + +Apache OpenNLP is a **library** and a set of **command-line tools** for natural +language processing. It is not a server. It opens no listening sockets, runs no +daemons, has no user accounts, no authentication, no authorization, and no web +interface. It executes entirely inside the process and with the privileges of the +application that embeds it, or of the user who invokes the CLI. + +Consequently, this security model is almost entirely about **input trust +boundaries**: which inputs OpenNLP is designed to survive when they are hostile, +and which it is not. + +### The short version + +- **Text you analyze is untrusted.** OpenNLP is designed to process hostile text + safely. Crashes, hangs, and unbounded memory growth caused by crafted *text* + are vulnerabilities. Report them. +- **Models, dictionaries, and training data are trusted.** They are closer to Review Comment: Should we clarify here that some models may be untrusted unless they come from the ASF servers and the SHA-512 match? I don't want users to think that _any_ model is inherently trusted. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
