opensafely-core / opensafely-core/reports
Allowing arbitrary HTML to be published by researchers could introduce vulnerabilities in the Output Explorer
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 0
- Forks
- 1
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 5
Description
Ideas:
- put user output on a separate domain to the main UI for security reasons
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points; start by locating how the Output Explorer publishes researcher HTML and how it is deployed relative to the main UI. Done means arbitrary researcher output cannot compromise the main UI, with the isolation approach documented and covered by relevant security checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100