osasukev57-venn commented on issue #4382:
URL: https://github.com/apache/hertzbeat/issues/4382#issuecomment-5724118109
Hi maintainers,
I'm interested in contributing to this hardening effort. I recently
submitted PR #4386 addressing the SSRF webhook validation issue (#4383), and
I'd like to help with this one as well.
Before I start, I'd like to clarify the expected scope and direction:
1. **Is this open to external PRs?** The issue mentions aligning with the
role-enforcement work planned for 1.9.0 — would you prefer contributors to wait
for that, or is a standalone hardening PR welcome now?
2. **Which of the three suggested hardening items should be prioritized?**
- Gate `POST /api/apps/define/yml` to admin-only
- Allowlist collect protocols (exclude script/ssh/command) in
user-authored templates
- Shell-escape `^_^param^_^` substitutions
3. **Should these be one combined PR or separate PRs?**
I'm happy to start with the protocol allowlist validation as it seems
relatively self-contained, but I'd appreciate your guidance on the preferred
approach.
Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
