OpenAPITools / OpenAPITools/openapi-generator

[BUG][PHP-laravel] Potential security risk due to resources hosted on external CDNs

Open
#14,440 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Bug Report Checklist
Description

An internal security tool from the company I am working in, reported potential security breaches and violations of the internal company policies regarding code practices in php-laravel generator.

Those issues were introduced by the initial import of the php-laravel generator (https://github.com/OpenAPITools/openapi-generator/pull/574) and lately updated in https://github.com/OpenAPITools/openapi-generator/pull/6346.

openapi-generator version

Issue present on master.

Steps to reproduce

None.

Related issues/PRs

Never reported before.

Suggest a fix

Pulling this CSS file does not seem a main feature and creates noises for internal security tools.
Do you see any issue with deleting/commenting them out ?

If you agree on the approach, I can create a PR.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the referenced external-resource lines in php-laravel/resources/views/welcome.blade.php and validator/index.mustache. Confirm which CDN resources are emitted by these templates and decide whether removing or commenting them out meets the security concern. Done means the unwanted external CDN references are no longer present in the affected generated resources.

Written by the indexing model from the issue text.

Assessment

Tech stack
laravel, php
Domain
security, web-dev
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.