apache / apache/answer-plugins

New plugin use-case/type of plugin: Credentials Guard

Aperta
#63 2 commenti 2 reazioni 0 assegnatari Vedi su GitHub
feature
Lingua principale
Go
Stelle
131
Fork
75
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

Hi 👋,

First of all, thanks for providing _Answer_ and congrats for joining Apache 👍

I'm having a plugin use-case in mind I'd like to work on, that is - as far as I'm able to see - [currently not supported](https://answer.apache.org/docs/plugins/#plugin-type).

**Idea/Use-Case**

I'd like to implement a plugin that checks user submitted content for security sensitive information like credentials and asks
the user if the content really should be submitted as is.
Submitting such kind of information if fairly easy especially if you're copy & pasting code snippets (totally unrelated to Answer itself obviously).

This would allow to not even persist sensitive data in case it's not intended by the user. Persisiting sensitive information is an issue as Answer keeps the content history - which is really great in general (I really like the diff functionality ❤️) but not in case you submit something that better shouldn't have been.
To detect credentials potentially, I was thinking about using something like e.g. [DeepPass](https://github.com/GhostPack/DeepPass).

_Additional thoughts_
* it potentially involves both frontend and backend functionality
* needs to intervene (optionally with user consent) before data gets persisted
* should involve scanning user questions, answers and comments, basically all user submitted content

Looking forward for feedback 😃

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Start with the plugin-type documentation linked in the issue and inspect the repository's existing plugin types and extension points. Define the scope for scanning questions, answers, and comments before persistence, including optional user consent and content history; done requires an agreed plugin type and implementation scope.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Ambito
backend, frontend, security
Tipo di issue
Funzionalità
Difficoltà
5/5
Tempo stimato
Più di una settimana
Stato di attività
Ferma
Chiarezza
Da chiarire
Idoneità per principianti
25/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.