From b7f122c03162f4f8288f244ff415b19bcba8f8d8 Mon Sep 17 00:00:00 2001 From: Mark Pitblado Date: Wed, 25 Dec 2024 08:28:21 -0800 Subject: [PATCH 1/2] Update 08-security-considerations.md Add missing "t" to "untrusted" --- .../version-v0.20.0/08-security-considerations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/versioned_docs/version-v0.20.0/08-security-considerations.md b/docs/versioned_docs/version-v0.20.0/08-security-considerations.md index 7cab2e07b..5a2955262 100644 --- a/docs/versioned_docs/version-v0.20.0/08-security-considerations.md +++ b/docs/versioned_docs/version-v0.20.0/08-security-considerations.md @@ -2,7 +2,7 @@ If you're going to give app access to untrusted users, there's some security considerations that you'll need to be aware of given how the crawler works. The crawler is basically running a browser to fetch the content of the bookmarks. Any untrusted user can submit bookmarks to be crawled from your server and they'll be able to see the crawling result. This can be abused in multiple ways: -1. Untrused users can submit crawl requests to websites that you don't want to be coming out of your IPs. +1. Untrusted users can submit crawl requests to websites that you don't want to be coming out of your IPs. 2. Crawling user controlled websites can expose your origin IP (and location) even if your service is hosted behind cloudflare for example. 3. The crawling requests will be coming out from your own network, which untrusted users can leverage to crawl internal non-internet exposed endpoints. From 4be70d3e81cfc9cd7b2caff73ee29eff26cb7b34 Mon Sep 17 00:00:00 2001 From: Mark Pitblado Date: Fri, 27 Dec 2024 21:46:39 -0800 Subject: [PATCH 2/2] fix: add missing "t" to untrusted --- docs/docs/08-security-considerations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docs/08-security-considerations.md b/docs/docs/08-security-considerations.md index 7cab2e07b..5a2955262 100644 --- a/docs/docs/08-security-considerations.md +++ b/docs/docs/08-security-considerations.md @@ -2,7 +2,7 @@ If you're going to give app access to untrusted users, there's some security considerations that you'll need to be aware of given how the crawler works. The crawler is basically running a browser to fetch the content of the bookmarks. Any untrusted user can submit bookmarks to be crawled from your server and they'll be able to see the crawling result. This can be abused in multiple ways: -1. Untrused users can submit crawl requests to websites that you don't want to be coming out of your IPs. +1. Untrusted users can submit crawl requests to websites that you don't want to be coming out of your IPs. 2. Crawling user controlled websites can expose your origin IP (and location) even if your service is hosted behind cloudflare for example. 3. The crawling requests will be coming out from your own network, which untrusted users can leverage to crawl internal non-internet exposed endpoints.