apache / apache/answer-plugins

New plugin use-case/type of plugin: Credentials Guard

Abierto
#63 2 comentarios 2 reacciones 0 asignados Ver en GitHub
feature
Lenguaje dominante
Go
Estrellas
131
Forks
75
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

Hi 👋,

First of all, thanks for providing _Answer_ and congrats for joining Apache 👍

I'm having a plugin use-case in mind I'd like to work on, that is - as far as I'm able to see - [currently not supported](https://answer.apache.org/docs/plugins/#plugin-type).

**Idea/Use-Case**

I'd like to implement a plugin that checks user submitted content for security sensitive information like credentials and asks
the user if the content really should be submitted as is.
Submitting such kind of information if fairly easy especially if you're copy & pasting code snippets (totally unrelated to Answer itself obviously).

This would allow to not even persist sensitive data in case it's not intended by the user. Persisiting sensitive information is an issue as Answer keeps the content history - which is really great in general (I really like the diff functionality ❤️) but not in case you submit something that better shouldn't have been.
To detect credentials potentially, I was thinking about using something like e.g. [DeepPass](https://github.com/GhostPack/DeepPass).

_Additional thoughts_
* it potentially involves both frontend and backend functionality
* needs to intervene (optionally with user consent) before data gets persisted
* should involve scanning user questions, answers and comments, basically all user submitted content

Looking forward for feedback 😃

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Línea de trabajo

Comienza con la documentación del tipo de plugin enlazada en la issue e inspecciona los tipos de plugin y los puntos de extensión existentes en el repositorio. Define el alcance del escaneo de preguntas, respuestas y comentarios antes de la persistencia, incluyendo el consentimiento opcional del usuario y el historial del contenido; se considera terminado cuando se hayan acordado un tipo de plugin y el alcance de la implementación.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Área
backend, frontend, security
Tipo de issue
Nueva funcionalidad
Dificultad
5/5
Tiempo estimado
Más de una semana
Estado de actividad
Estancado
Claridad
Necesita aclaración
Aptitud para principiantes
25/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.