AtHeartEngineer/ejs
1
0
Fork 0
mirror of https://github.com/CryptKeeperZK/ejs.git synced 2026-01-08 15:13:50 -05:00
Code Issues Packages Projects Releases Wiki Activity

Update SECURITY.md

Browse Source
This commit is contained in:
Matthew Eernisse
2023-03-27 11:04:07 -07:00
committed by GitHub
parent 689ca02f02
commit 828cea1687
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
SECURITY.md
View File

@@ -19,4 +19,14 @@ To ensure the timely response to your report, please ensure that the entirety of
The EJS team will then evaluate your report and will reply with the next steps in handling your report and may ask for additional information or guidance.
## Out-of-Scope Vulnerabilities
If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that. EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results.
If you give end-users unfettered access to the EJS render method, you are using EJS in an inherently un-secure way. Please do not report security issues that stem from doing that.
EJS is effectively a JavaScript runtime. Its entire job is to execute JavaScript. If you run the EJS render method without checking the inputs yourself, you are responsible for the results.
In short, DO NOT send reports including this snippet of code:
```javascript
app.get('/', (req, res) => {
res.render('index', req.query);
});
```