Security

Copy Markdown View Source

Reporting a vulnerability

Do not open a public issue for a security problem. Report it privately through GitHub: Report a vulnerability.

Say what an attacker can do, and how: the definition and the host's mount, the request or the event, and the steps or the payload. We answer within a week, agree on a fix and a date, and credit you in the advisory unless you ask us not to.

Supported versions

Security fixes are made to the latest release. PhoenixMountable is before 1.0, so a fix is not backported to an earlier minor version.

What is in scope

PhoenixMountable puts a library's routes, live sessions and assets in a host app, and runs its migrations in the host's database. A problem is in scope when PhoenixMountable itself lets a request, an event, or the options a host passes:

  • reach a library's route without the host's scope, pipelines or on_mount hooks that the mount was placed under;
  • read a file outside the directory of a library's built assets (the Static strategy), or any file under a URL the library did not declare;
  • inject script into a page through the meta tags, the layout or the mount's path, or get around the request's CSP nonces;
  • see or change another mount's session, options, processes or PubSub messages;
  • run SQL of their own through the migrations, a backfill or the schema check;
  • crash the host, or make the server or the database do unbounded work.

What a library does inside its routes is the library's: who may see a page is decided by its resolver or its on_mount hooks, and by the pipelines the host mounts it under. Report a problem in a library built with PhoenixMountable to that library.