OpenAPITools / OpenAPITools/openapi-generator
[BUG][PHP-laravel] Potential security risk due to resources hosted on external CDNs
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 26.8k
- Forks
- 7.7k
- PR merge metrics
- PR metrics pending
Description
Bug Report Checklist
Description
An internal security tool from the company I am working in, reported potential security breaches and violations of the internal company policies regarding code practices in php-laravel generator.
Those issues were introduced by the initial import of the php-laravel generator (https://github.com/OpenAPITools/openapi-generator/pull/574) and lately updated in https://github.com/OpenAPITools/openapi-generator/pull/6346.
- --/src/main/resources/php-laravel/resources/views/welcome.blade.php#L10
A CSS style sheet for a font included fromfonts.googleapis.com - --/src/main/resources/validator/index.mustache#L204
A mustache file with the same issue mentioned above.
openapi-generator version
Issue present on master.
Steps to reproduce
None.
Related issues/PRs
Never reported before.
Suggest a fix
Pulling this CSS file does not seem a main feature and creates noises for internal security tools.
Do you see any issue with deleting/commenting them out ?
If you agree on the approach, I can create a PR.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the referenced external-resource lines in php-laravel/resources/views/welcome.blade.php and validator/index.mustache. Confirm which CDN resources are emitted by these templates and decide whether removing or commenting them out meets the security concern. Done means the unwanted external CDN references are no longer present in the affected generated resources.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- laravel, php
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100