apache / apache/answer-plugins

New plugin use-case/type of plugin: Credentials Guard

未关闭
#63 2 条评论 2 个 reaction 已指派 0 人 在 GitHub 查看
feature
主要语言
Go
星标
131
派生
75
PR 合并指标
30 天内没有已合并 PR

描述

Hi 👋,

First of all, thanks for providing _Answer_ and congrats for joining Apache 👍

I'm having a plugin use-case in mind I'd like to work on, that is - as far as I'm able to see - [currently not supported](https://answer.apache.org/docs/plugins/#plugin-type).

**Idea/Use-Case**

I'd like to implement a plugin that checks user submitted content for security sensitive information like credentials and asks
the user if the content really should be submitted as is.
Submitting such kind of information if fairly easy especially if you're copy & pasting code snippets (totally unrelated to Answer itself obviously).

This would allow to not even persist sensitive data in case it's not intended by the user. Persisiting sensitive information is an issue as Answer keeps the content history - which is really great in general (I really like the diff functionality ❤️) but not in case you submit something that better shouldn't have been.
To detect credentials potentially, I was thinking about using something like e.g. [DeepPass](https://github.com/GhostPack/DeepPass).

_Additional thoughts_
* it potentially involves both frontend and backend functionality
* needs to intervene (optionally with user consent) before data gets persisted
* should involve scanning user questions, answers and comments, basically all user submitted content

Looking forward for feedback 😃

贡献指南

这个仓库没有索引到贡献指南

调研方向

从 issue 中链接的插件类型文档开始,检查 repository 中现有的插件类型和扩展点。确定在持久化之前扫描问题、答案和评论的范围,包括可选的用户同意和内容历史;完成标准是已就插件类型和实现范围达成一致。

由索引模型根据 Issue 内容生成。

评估

领域
backend, frontend, security
Issue 类型
功能
难度
5/5
预计耗时
一周以上
活跃度
停滞
描述清晰度
需要澄清
新手友好度
25/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。