Skip to content

Commit aae7960

Browse files
xet7xet7
committed
Updated security.md.
Thanks to xet7 !
1 parent b99f878 commit aae7960

File tree

1 file changed

+115
-31
lines changed

1 file changed

+115
-31
lines changed

‎SECURITY.md‎

Lines changed: 115 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -48,31 +48,121 @@ like Snap and Docker have their own specific sandboxing etc features.
4848

4949
Standalone Wekan by default does not load any files from Internet, like fonts, CSS, etc.
5050
This also means all Standalone Wekan functionality works in offline local networks.
51-
Wekan is used by companies that have [thousands of users](https://github.com/wekan/wekan/wiki/AWS) and at healthcare.
52-
53-
Wekan uses xss package for input fields like cards, as you can see from
54-
[package.json](https://github.com/wekan/wekan/blob/main/package.json). Other used versions can be seen from
55-
[Meteor versions file](https://github.com/wekan/wekan/blob/main/.meteor/versions).
56-
Forms can include markdown links, html, image tags etc like you see at https://wekan.github.io .
57-
It's possible to add attachments to cards, and markdown/html links to files.
58-
59-
Wekan attachments are not accessible without logging in. Import from Trello works by copying
60-
Trello export JSON to Wekan Trello import page, and in Trello JSON file there is direct links to all publicly
61-
accessible Trello attachment files, that Standalone Wekan downloads directly to Wekan MongoDB database in
62-
[CollectionFS](https://github.com/wekan/wekan/pull/875) format. When Wekan board is exported in
63-
Wekan JSON format, all board attachments are included in Wekan JSON file as base64 encoded text.
64-
That Wekan JSON format file can be imported to Sandstorm Wekan with all the attachments, when we get
65-
latest Wekan version working on Sandstorm, only couple of bugs are left before that. In Sandstorm it's not
66-
possible yet to import from Trello with attachments, because Wekan does not implement Sandstorm-compatible
67-
access to outside of Wekan grain.
68-
69-
Standalone Wekan only has password auth currently, there is work in progress to add
70-
[oauth2](https://github.com/wekan/wekan/pull/1578), [Openid](https://github.com/wekan/wekan/issues/538),
71-
[LDAP](https://github.com/wekan/wekan/issues/119) etc. If you need more login security for Standalone Wekan now,
72-
it's possible add additional [Google Auth proxybouncer](https://github.com/wekan/wekan/wiki/Let's-Encrypt-and-Google-Auth) in front of password auth, and then use Google Authenticator for Google Auth. Standalone Wekan does have [brute force protection with eluck:accounts-lockout and browser-policy clickjacking protection](https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v080-2018-04-04-wekan-release). You can also optionally use some [WAF](https://en.wikipedia.org/wiki/Web_application_firewall)
73-
like for example [AWS WAF](https://aws.amazon.com/waf/).
74-
75-
[All Wekan Platforms](https://github.com/wekan/wekan/wiki/Platforms)
51+
WeKan is used at most countries of the world https://snapcraft.io/wekan
52+
and by by companies that have 30k users.
53+
54+
- Wekan private board attachments are not accessible without logging in.
55+
- There is feature to set board public, so that board is visible without logging in in readonly mode, with realtime updates.
56+
- Admin Panel has feature to disable all public boards, so all boards are private.
57+
58+
## SSL/TLS
59+
60+
- SSL/TLS encrypts traffic between webbrowser and webserver.
61+
- If you are thinking about TLS MITM, look at Caddy 2 webserver MITM detections.
62+
- Let's Encrypt TLS requires publicly accessible webserver, that Let's Encrypt TLS validation servers check.
63+
- If firewall limits to only allowed IP addresses, you may need non-Let's Encrypt TLS cert.
64+
- For On Premise:
65+
- https://caddyserver.com/docs/automatic-https#local-https
66+
- https://github.com/wekan/wekan/wiki/Caddy-Webserver-Config
67+
- https://github.com/wekan/wekan/wiki/Azure
68+
- https://github.com/wekan/wekan/wiki/Traefik-and-self-signed-SSL-certs
69+
70+
## XSS
71+
72+
- Dompurify https://www.npmjs.com/package/dompurify
73+
- WeKan uses dompurify npm package to filter for XSS at fields like cards, as you can see from
74+
[package.json](https://github.com/wekan/wekan/blob/main/package.json). Other used versions can be seen from
75+
[Meteor versions file](https://github.com/wekan/wekan/blob/main/.meteor/versions).
76+
- Forms can include markdown links, html, image tags etc like you see at https://wekan.github.io .
77+
- It's possible to add attachments to cards, and markdown/html links to files.
78+
- Dompurify cleans up viewed code, so Javascript in input fields does not execute
79+
- https://wekan.github.io/hall-of-fame/fieldbleed/
80+
- Reaction in comment is now checked, that it does not have extra added code
81+
- https://wekan.github.io/hall-of-fame/reactionbleed/
82+
- https://github.com/wekan/wekan/blob/main/packages/markdown/src/template-integration.js#L76
83+
84+
## QA about PubSub
85+
86+
Q:
87+
88+
Hello,
89+
I have just seen the Meteor DevTools Evolved extension and was wondering if anyone had asked themselves the question of security.
90+
Insofar as all data is shown in the minimongo tab in plain text.
91+
How can data be hidden from this extension?
92+
93+
A:
94+
95+
## PubSub
96+
97+
- Publish/Subscribe means, that realtime web framework reads database changes stream, and then immediately updates webpage,
98+
like like dashboards, chat, kanban. That is the point in any realtime web framework in any programming language.
99+
- PubSub uses Websockets, so you need those to be enabled at webserver like Caddy/Nginx/Apache etc, examples of settings
100+
at right menu of https://github.com/wekan/wekan/wiki
101+
- Clientside https://github.com/wekan/wekan/tree/main/client/components subscribes to those
102+
pubsub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods at https://github.com/wekan/wekan/tree/main/models
103+
- You should not include any data user is not allowed to see. Not to webpage text, not to websockets/PubSub, etc.
104+
- Check permissions and sanitize before allowing some change, because someone could modify content of input field, PubSub/websocket data, etc.
105+
- It is not security issue to show some text, that user has permission to see.
106+
- Do not include password hashes in PubSub https://wekan.github.io/hall-of-fame/userbleed/
107+
- For Admin:
108+
- You can have input field for password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
109+
- You can save password to database https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
110+
- Check that only current user or Admin can change password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
111+
- Do not have password hashes in PubSub https://github.com/wekan/wekan/blob/main/server/publications/users.js
112+
- Only show Admin Panel to Admin https://github.com/wekan/wekan/blob/main/client/components/settings/settingBody.jade#L3
113+
- Use Environment variables for any email etc passwords.
114+
115+
## PubSub: Fix that user can not change to Admin
116+
117+
- With PubSub, there is checking, that someone modifying Websockets content, like permission isAdmin, can not change to Admin.
118+
- https://github.com/wekan/wekan/commit/cbad4cf5943d47b916f64b4582f8ca76a9dfd743
119+
- https://wekan.github.io/hall-of-fame/adminbleed/
120+
121+
## Permissions and Roles
122+
123+
- For any user permissions, it's best to use Meteor package package https://github.com/Meteor-Community-Packages/meteor-roles .
124+
- Currently WeKan has custom hardcoded permissions, WeKan does not yet use that meteor-roles package.
125+
- Using permissions at WeKan sidebar https://github.com/wekan/wekan/blob/main/client/components/sidebar/sidebar.js#L1854-L1875
126+
- List of roles https://github.com/wekan/wekan/wiki/REST-API-Role . Change at board or Admin Panel. Also Organizations/Teams.
127+
- Worker role: https://github.com/wekan/wekan/issues/2788
128+
- Not implemented yet: Granular Roles https://github.com/wekan/wekan/issues/3022
129+
- Check is user logged in, with `if (Meteor.user()) {`
130+
- Check is code running at server `if (Meteor.isServer()) {` or client `if Meteor.isClient()) {` .
131+
- Here is some authentication code https://github.com/wekan/wekan/blob/main/server/authentication.js
132+
133+
## Environment variables
134+
135+
- For any passwords, use environment variables, those are serverside
136+
- Do not copy environment variable to public variable that is visible browserside https://github.com/wekan/wekan/blob/main/server/max-size.js
137+
138+
```
139+
Meteor.startup(() => {
140+
if (process.env.HEADER_LOGIN_ID) {
141+
Meteor.settings.public.attachmentsUploadMaxSize = process.env.ATTACHMENTS_UPLOAD_MAX_SIZE;
142+
Meteor.settings.public.attachmentsUploadMimeTypes = process.env.ATTACHMENTS_UPLOAD_MIME_TYPES;
143+
Meteor.settings.public.avatarsUploadMaxSize = process.env.AVATARS_UPLOAD_MAX_SIZE;
144+
```
145+
146+
- For serverside, you can set Meteor.settings.variablename, without text public
147+
- For WeKan kanban, there is feature for setting board public, it can be viewed by anyone, there is realtime updates. But
148+
- Some of those permissions are checked at users.js models at https://github.com/wekan/wekan/tree/main/models
149+
- Environment variables are used for email server passwords, etc, at all platforms https://github.com/wekan/wekan/commit/a781c0e7dcfdbe34c1483ee83cec12455b7026f7
150+
151+
## Escape HTML comment tags so that HTML comments are visible
152+
153+
- Someone reported, that it is problem that content of HTML comments in edit mode, are not visible at at view mode, so this makes HTML comments visible.
154+
- https://github.com/wekan/wekan/commit/167863d95711249e69bb3511175d73b34acbbdb3
155+
- https://wekan.github.io/hall-of-fame/invisiblebleed/
156+
157+
## Attachments: XSS in filename is sanitized
158+
159+
- https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
160+
- https://wekan.github.io/hall-of-fame/filebleed/
161+
162+
## Brute force login protection
163+
164+
- https://github.com/wekan/wekan/commit/23e5e1e3bd081699ce39ce5887db7e612616014d
165+
- https://github.com/wekan/wekan/tree/main/packages/wekan-accounts-lockout
76166

77167
### Sandstorm Wekan Security
78168

@@ -105,12 +195,6 @@ a security issue, we'd like to know about it, and also how to fix it:
105195

106196
Typical already known or "no impact" bugs such as:
107197

108-
- Brute force password guessing. Currently there is
109-
[brute force protection with eluck:accounts-lockout](https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v080-2018-04-04-wekan-release).
110-
- Security issues related to that Wekan uses Meteor 1.6.0.1 related packages, and upgrading to newer
111-
Meteor 1.6.1 is complicated process that requires lots of changes to many dependency packages.
112-
Upgrading [has been tried many times, spending a lot of time](https://github.com/meteor/meteor/issues/9609)
113-
but there still is issues. Helping with package upgrades is very welcome.
114198
- [Wekan API old tokens not replaced correctly](https://github.com/wekan/wekan/issues/1437)
115199
- Missing Cookie flags on non-session cookies or 3rd party cookies
116200
- Logout CSRF

0 commit comments

Comments
 (0)