Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable StrictMode security tool #16953

Open
5 tasks
irfano opened this issue Jul 26, 2022 · 0 comments
Open
5 tasks

Enable StrictMode security tool #16953

irfano opened this issue Jul 26, 2022 · 0 comments

Comments

@irfano
Copy link
Member

irfano commented Jul 26, 2022

StrictMode is a developer tool which detects things you might be doing by accident and brings them to your attention so you can fix them. Currently, it's commented in WordPressDebug.
We had a security vulnerability (Slack ref: p1656678398776749-slack-CRA4UEQQ3) caused by unsafe intent launch which could be detected by StrictMode's detectUnsafeIntentLaunch().
In this issue, we need to

  • add detectUnsafeIntentLaunch() in StrictMode detections,
  • investigate other detections that might be beneficial,
  • check if enabling StrictMode have any significant drawback, if not, enable it for all debug builds,
  • enable StrictMode detections in automated tests of CI,
  • investigate other security tools. (If we can find good tools, we can use them in place of StrictMode or addition to StrictMode)

If these are a lot for a PR, multiple PRs can fix this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant