xixu-me
ed4ac6c9fb
- Created detailed YAML templates for various issue types to streamline user submissions and improve issue tracking. - Added a comprehensive pull request template to guide contributors in providing necessary information. - Developed a contributing guide to outline project setup, contribution types, testing procedures, and code style guidelines.
218 lines
6.9 KiB
YAML
218 lines
6.9 KiB
YAML
name: Security Vulnerability
|
|
description: Report a security vulnerability in tzst (please follow responsible disclosure)
|
|
title: "[SECURITY] "
|
|
labels: ["security", "needs-triage"]
|
|
assignees: []
|
|
body:
|
|
- type: markdown
|
|
attributes:
|
|
value: |
|
|
# Security Vulnerability Report
|
|
|
|
**⚠️ IMPORTANT: For serious security vulnerabilities, please consider using private reporting instead of a public issue.**
|
|
|
|
If this is a critical security vulnerability that could be exploited, please:
|
|
1. Email the maintainers privately first
|
|
2. Allow time for a security patch before public disclosure
|
|
3. Follow responsible disclosure practices
|
|
|
|
For less critical security issues or general security improvements, this public issue form is appropriate.
|
|
|
|
- type: checkboxes
|
|
id: disclosure
|
|
attributes:
|
|
label: Responsible Disclosure
|
|
description: Please confirm your approach to reporting this security issue.
|
|
options:
|
|
- label: I understand the importance of responsible disclosure for security vulnerabilities
|
|
required: true
|
|
- label: This is not a critical vulnerability that requires private reporting
|
|
required: true
|
|
- label: I have considered the potential impact of public disclosure
|
|
required: true
|
|
|
|
- type: dropdown
|
|
id: severity
|
|
attributes:
|
|
label: Severity Level
|
|
description: How severe do you consider this security issue?
|
|
options:
|
|
- Critical (immediate action required)
|
|
- High (significant security risk)
|
|
- Medium (moderate security concern)
|
|
- Low (minor security improvement)
|
|
- Informational (security-related best practice)
|
|
validations:
|
|
required: true
|
|
|
|
- type: dropdown
|
|
id: vulnerability-type
|
|
attributes:
|
|
label: Vulnerability Type
|
|
description: What type of security issue is this?
|
|
options:
|
|
- Path traversal / Directory traversal
|
|
- Archive bomb / Zip bomb
|
|
- Arbitrary file overwrite
|
|
- Symlink attack
|
|
- Information disclosure
|
|
- Denial of Service (DoS)
|
|
- Memory corruption
|
|
- Injection vulnerability
|
|
- Privilege escalation
|
|
- Cryptographic weakness
|
|
- Input validation bypass
|
|
- Other
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: description
|
|
attributes:
|
|
label: Vulnerability Description
|
|
description: Describe the security vulnerability in detail.
|
|
placeholder: |
|
|
Provide a clear description of the security issue:
|
|
- What component is affected?
|
|
- What is the vulnerability?
|
|
- What are the potential consequences?
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: attack-scenario
|
|
attributes:
|
|
label: Attack Scenario
|
|
description: Describe how this vulnerability could be exploited.
|
|
placeholder: |
|
|
Describe a realistic attack scenario:
|
|
1. Attacker creates malicious archive with...
|
|
2. Victim extracts archive using tzst...
|
|
3. Result: files written outside extraction directory / code execution / etc.
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: impact
|
|
attributes:
|
|
label: Impact Assessment
|
|
description: What is the potential impact of this vulnerability?
|
|
placeholder: |
|
|
Describe the potential impact:
|
|
- Confidentiality: Can sensitive data be exposed?
|
|
- Integrity: Can files be modified unexpectedly?
|
|
- Availability: Can the system be made unavailable?
|
|
- Scope: Who would be affected?
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: affected-versions
|
|
attributes:
|
|
label: Affected Versions
|
|
description: Which versions of tzst are affected by this vulnerability?
|
|
placeholder: |
|
|
- tzst version tested:
|
|
- Likely affected versions:
|
|
- Known safe versions (if any):
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: reproduce
|
|
attributes:
|
|
label: Proof of Concept
|
|
description: Provide steps to reproduce or demonstrate the vulnerability.
|
|
placeholder: |
|
|
**WARNING: Please ensure your PoC is safe and doesn't cause actual harm**
|
|
|
|
Steps to reproduce:
|
|
1. Create test archive with specific structure...
|
|
2. Run tzst command...
|
|
3. Observe security issue...
|
|
|
|
Or provide code that demonstrates the issue safely.
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: mitigation
|
|
attributes:
|
|
label: Suggested Mitigation
|
|
description: Do you have suggestions for how to fix this vulnerability?
|
|
placeholder: |
|
|
Suggested fixes or mitigations:
|
|
- Input validation improvements
|
|
- Security filter enhancements
|
|
- API changes needed
|
|
- Configuration options
|
|
validations:
|
|
required: false
|
|
|
|
- type: checkboxes
|
|
id: security-features
|
|
attributes:
|
|
label: Related Security Features
|
|
description: Which tzst security features are involved?
|
|
options:
|
|
- label: Extraction filters (data, tar, etc.)
|
|
- label: Path validation
|
|
- label: Symlink handling
|
|
- label: Archive format validation
|
|
- label: Memory limits
|
|
- label: File size limits
|
|
- label: Atomic operations
|
|
- label: Temporary file handling
|
|
- label: Error handling and cleanup
|
|
|
|
- type: textarea
|
|
id: references
|
|
attributes:
|
|
label: References
|
|
description: Any relevant CVEs, security advisories, or research papers.
|
|
placeholder: |
|
|
Related security research:
|
|
- CVE numbers:
|
|
- Security advisories:
|
|
- Research papers:
|
|
- Similar vulnerabilities in other tools:
|
|
validations:
|
|
required: false
|
|
|
|
- type: textarea
|
|
id: environment
|
|
attributes:
|
|
label: Environment Details
|
|
description: Platform and environment details relevant to this vulnerability.
|
|
placeholder: |
|
|
- Operating System:
|
|
- Python version:
|
|
- tzst version:
|
|
- Specific environment factors:
|
|
validations:
|
|
required: false
|
|
|
|
- type: checkboxes
|
|
id: disclosure-timeline
|
|
attributes:
|
|
label: Disclosure Timeline
|
|
description: What is your intended disclosure timeline?
|
|
options:
|
|
- label: I plan to disclose this publicly immediately
|
|
- label: I can wait for a security fix before public disclosure
|
|
- label: I am requesting coordinated disclosure
|
|
- label: This has already been disclosed elsewhere
|
|
|
|
- type: textarea
|
|
id: additional-info
|
|
attributes:
|
|
label: Additional Information
|
|
description: Any other relevant security information.
|
|
placeholder: |
|
|
Additional context:
|
|
- How did you discover this vulnerability?
|
|
- Are you aware of any exploitation in the wild?
|
|
- Any other relevant details?
|
|
validations:
|
|
required: false
|