rzo1 opened a new pull request, #13: URL: https://github.com/apache/openjpa-site/pull/13
This is a first (LLM-assisted) draft of a security model for OpenJPA, similar to the one Storm has (https://storm.apache.org/security-model.html). The goal is to reduce the number of incoming CVE reports against OpenJPA, which will come sooner or later: it states what OpenJPA trusts (the application, its configuration and mapping metadata), what it treats as untrusted input (bound parameters, entity values), what deployers are responsible for (e.g. the TCP remote commit provider is for cluster members only), and which reports we consider in or out of scope. The found-a-bug page links to it. Please have a close look and give feedback, in particular on the in/out of scope lists. One open point: the new page sends reports to [email protected], while found-a-bug.md still says [email protected]. We should settle on one. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
