Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HTML wrapping middleware is redundant with WAF enabled #5197

Closed
14 tasks
dsotirho-ucsc opened this issue May 9, 2023 · 1 comment
Closed
14 tasks

HTML wrapping middleware is redundant with WAF enabled #5197

dsotirho-ucsc opened this issue May 9, 2023 · 1 comment
Assignees
Labels
code [subject] Production code debt [type] A defect incurring continued engineering cost demo [process] To be demonstrated at the end of the sprint demoed [process] Successfully demonstrated to team enh [type] New feature or request orange [process] Done by the Azul team

Comments

@dsotirho-ucsc
Copy link
Contributor

dsotirho-ucsc commented May 9, 2023

Remove addition from https://github.com/databiosphere/azul-private/issues/12 (PR #5035)


  • Security design review completed; the Resolution of this issue does not
    • … affect authentication; for example:
      • OAuth 2.0 with the application (API or Swagger UI)
      • Authentication of developers with Google Cloud APIs
      • Authentication of developers with AWS APIs
      • Authentication with a GitLab instance in the system
      • Password and 2FA authentication with GitHub
      • API access token authentication with GitHub
      • Authentication with
    • … affect the permissions of internal users like access to
      • Cloud resources on AWS and GCP
      • GitLab repositories, projects and groups, administration
      • an EC2 instance via SSH
      • GitHub issues, pull requests, commits, commit statuses, wikis, repositories, organizations
    • … affect the permissions of external users like access to
      • TDR snapshots
    • … affect permissions of service or bot accounts
      • Cloud resources on AWS and GCP
    • … affect audit logging in the system, like
      • adding, removing or changing a log message that represents an auditable event
      • changing the routing of log messages through the system
    • … affect monitoring of the system
    • … introduce a new software dependency like
      • Python packages on PYPI
      • Command-line utilities
      • Docker images
      • Terraform providers
    • … add an interface that exposes sensitive or confidential data at the security boundary
    • … affect the encryption of data at rest
    • … require persistence of sensitive or confidential data that might require encryption at rest
    • … require unencrypted transmission of data within the security boundary
    • … affect the network security layer; for example by
      • modifying, adding or removing firewall rules
      • modifying, adding or removing security groups
      • changing or adding a port a service, proxy or load balancer listens on
  • Documentation on any unchecked boxes is provided in comments below
@dsotirho-ucsc dsotirho-ucsc added the orange [process] Done by the Azul team label May 9, 2023
@dsotirho-ucsc dsotirho-ucsc self-assigned this May 10, 2023
@dsotirho-ucsc dsotirho-ucsc added enh [type] New feature or request debt [type] A defect incurring continued engineering cost code [subject] Production code labels May 10, 2023
dsotirho-ucsc added a commit that referenced this issue May 13, 2023
@hannes-ucsc
Copy link
Member

hannes-ucsc commented May 18, 2023

For demo, show that https://github.com/DataBiosphere/azul-private/issues/12 remains fixed in next Invicti scan report.

@hannes-ucsc hannes-ucsc added the demo [process] To be demonstrated at the end of the sprint label May 18, 2023
dsotirho-ucsc added a commit that referenced this issue May 19, 2023
@bvizzier-ucsc bvizzier-ucsc added the demoed [process] Successfully demonstrated to team label Jun 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
code [subject] Production code debt [type] A defect incurring continued engineering cost demo [process] To be demonstrated at the end of the sprint demoed [process] Successfully demonstrated to team enh [type] New feature or request orange [process] Done by the Azul team
Projects
None yet
Development

No branches or pull requests

3 participants