rzo1 opened a new pull request, #45: URL: https://github.com/apache/stormcrawler-site/pull/45
The security page covered trusted configuration, trusted Storm cluster access and multi-tenancy, but said nothing about the side of the system that actually faces the network. This adds: * a statement that crawled content is untrusted by design, and that consequences of the crawler crawling what it was configured to crawl are not in themselves vulnerabilities; * operator responsibilities with the relevant configuration keys and their shipped defaults: URL filtering (urlfilters.config.file ships commented out, archetypes supply default-regex-filters.txt), protocol schemes (protocols ships as "http,https,file"), egress restriction (http.filter.ipaddress.include/exclude, OkHttp only) and resource limits (http.content.limit defaults to -1, archetypes set 65536); * transport and credential handling: the rationale and the consequence of http.trust.everything defaulting to true, the lack of host scoping on http.basicauth credentials and cookie replay under http.use.cookies; * a short summary of when the project issues an advisory and when it treats a change as hardening, referencing ASF policy. The reporting process, trusted configuration, Storm cluster and known vulnerabilities sections are unchanged. security/index.html was also the only file in the repository still using CRLF line terminators, so it is converted to LF along with the edit. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
