Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a warning/error for non-standard config sections to improve the awareness of potential sec. issues #1

Open
pkarw opened this issue Jun 17, 2020 · 1 comment

Comments

@pkarw
Copy link

pkarw commented Jun 17, 2020

This would be super-useful because of: https://headless-security.org/vsf-best-practices.html#config-file-is-public

I can imagine we're notifying the user about all custom section they've got (especially for vue-storefront) in order to make sure they're not containing any sensitive information.

This PR could be a pretty useful foundation for this feature: vuestorefront/vue-storefront#3212

It's never been merged however it provides you with guidance on all the sections that are supported by VSF as of for Sep 2019 ;P

@jissereitsma
Copy link
Contributor

But why was it never merged? If PR 3212 could be merged anyway, I would be happy to take a look at integrating this in a VSF-based check, so that you can validate the configuration within the VSF PWA using yarn validate or something similar.

The reason I created this specific repository was to validate mainly configuration options that require Magento logic to properly validate: Like a check on Store View codes, product attributes, etcetera.

So I think a security validation would be making more sense in the PWA itself, then in a third party tool that nobody might use :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants