ChristopherSchultz commented on code in PR #1001: URL: https://github.com/apache/tomcat/pull/1001#discussion_r3740688361
########## SECURITY.md: ########## @@ -1,14 +1,136 @@ -# Security +# Security Policy -Apache Tomcat's security model and disclosure process are -published on the project website rather than in the repository: +## Before You Report - Required Self-Check -- **Threat model and security policy**: - <https://tomcat.apache.org/security-model.html> -- **How to report a vulnerability**: see the Security section - of <https://tomcat.apache.org/>. +**Complete this checklist. If you answer "No" to any question, do not submit a report:** -The project website is the authoritative source; this file -exists so agents and tooling that look for `SECURITY.md` in -the repository can mechanically follow the link to the -canonical documents. +- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces Review Comment: We might want to add "data stores" or something like that, here. I want to avoid reports of "oh, I put a serialized gadget into the session database and it exploded when Tomcat loaded it". ########## SECURITY.md: ########## @@ -1,14 +1,136 @@ -# Security +# Security Policy -Apache Tomcat's security model and disclosure process are -published on the project website rather than in the repository: +## Before You Report - Required Self-Check -- **Threat model and security policy**: - <https://tomcat.apache.org/security-model.html> -- **How to report a vulnerability**: see the Security section - of <https://tomcat.apache.org/>. +**Complete this checklist. If you answer "No" to any question, do not submit a report:** -The project website is the authoritative source; this file -exists so agents and tooling that look for `SECURITY.md` in -the repository can mechanically follow the link to the -canonical documents. +- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces +- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability, or I have provided a justification as to why a JUnit test case cannot be written for this report and I have provided a minimal proof of concept +- [ ] I have tested against a real Tomcat instance - this is not theoretical analysis or scanner output +- [ ] I am submitting in plain text (no PDFs, archives, videos, or formatted documents) + +**If you cannot check all boxes, your report will be rejected.** Review Comment: Should we require this checklist to be included in any submitted report? My corporate gitlab instance has a template for all MRs including checklists similar to this. ########## SECURITY.md: ########## @@ -1,14 +1,136 @@ -# Security +# Security Policy -Apache Tomcat's security model and disclosure process are -published on the project website rather than in the repository: +## Before You Report - Required Self-Check -- **Threat model and security policy**: - <https://tomcat.apache.org/security-model.html> -- **How to report a vulnerability**: see the Security section - of <https://tomcat.apache.org/>. +**Complete this checklist. If you answer "No" to any question, do not submit a report:** -The project website is the authoritative source; this file -exists so agents and tooling that look for `SECURITY.md` in -the repository can mechanically follow the link to the -canonical documents. +- [ ] I have read the [Tomcat Security Model](https://tomcat.apache.org/security-model.html) and my finding doesn't require access to config files, binaries, or admin interfaces +- [ ] I have written a working Tomcat JUnit test case that compiles, runs, and demonstrates the vulnerability, or I have provided a justification as to why a JUnit test case cannot be written for this report and I have provided a minimal proof of concept +- [ ] I have tested against a real Tomcat instance - this is not theoretical analysis or scanner output Review Comment: Should we also add "the most recent release of a supported Tomcat version" to this? I'm not saying we wouldn't accept a CVE against an older version (e.g. 8.5.last), though we obviously wouldn't fix it. But filing a CVE against 9.0.25 isn't helpful to anyone. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
