NBBPM needs controls for security vulnerabilities in plugins
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 15.2k
- Forks
- 3k
- Avg merge
- 16h 19m
- Merged PRs (30d)
- 167
Description
Security vulnerabilities will occur. It's one of the biggest banes of applications with a diverse plugin infrastructure, like wordpress.
If a vulnerability in a plugin is reported, there should be functionality in place to have that plugin not show up via nbbpm or show up as vulnerable. Ideally installing a plugin with known vulnerabilities is not as simple as "click install from the admin panel."
It'd be cool if sites that have installed the vulnerable plugin could be notified via the admin panel or whatever, but that'd involve some kind of update check or phoning home.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing plugin discovery and installation from the admin panel, then review how installed plugins are checked for updates. Clarify the vulnerability data source and the intended behavior for vulnerable plugins before implementation. Done should define the warning or blocking behavior for installs and how affected sites are notified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100