# Vulnerability Disclosure Contact

**URL:** <https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390>\
**Category:** Uncategorized\
**Created:** [March 20, 2019, 3:40pm UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390 "2019-03-20T15:40:30Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![MedAziz1](https://avatars.discourse-cdn.com/v4/letter/m/cc9497/32.png) [@MedAziz1](https://discourse.aurelia.io/u/MedAziz1)\
**Post date:** [March 20, 2019, 3:40pm UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/1 "2019-03-20T15:40:30Z")

</div>

Hello,

Recently in a secure code review mandate for one of our clients, the GoSecure AppSec team found a vulnerability in Aurelia. We’re searching for a contact in the Aurelia team in order to disclose it.

Thank you

---

<div class="post-metadata">

**Author:** ![constructor](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/constructor/32/710_2.png) [@constructor](https://discourse.aurelia.io/u/constructor)\
**Post date:** [March 20, 2019, 4:57pm UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/2 "2019-03-20T16:57:47Z")

</div>

Understanding that you can not disclose details, what severity rating would you give this vulnerability?

---

<div class="post-metadata">

**Author:** ![fkleuver](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/fkleuver/32/994_2.png) [@fkleuver](https://discourse.aurelia.io/u/fkleuver)\
**Post date:** [March 20, 2019, 5:25pm UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/3 "2019-03-20T17:25:38Z")

</div>

I just reached out to you via PM @MedAziz1

---

<div class="post-metadata">

**Author:** ![EisenbergEffect](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/eisenbergeffect/32/2655_2.png) [@EisenbergEffect](https://discourse.aurelia.io/u/EisenbergEffect)\
**Post date:** [March 20, 2019, 11:43pm UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/4 "2019-03-20T23:43:46Z")

</div>

Quick Update: For anyone watching this thread. We’re talking with @MedAziz1 presently. We’ll soon provide details of the vulnerability, as well as our remediatory actions, and what you can do in your codebase, if you are affected (and haven’t configured Aurelia to address the issue already).

---

<div class="post-metadata">

**Author:** ![tomtomau](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/tomtomau/32/780_2.png) [@tomtomau](https://discourse.aurelia.io/u/tomtomau)\
**Post date:** [April 8, 2019, 9:51am UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/5 "2019-04-08T09:51:16Z")

</div>

Any idea of when we can expect a response on this?

---

<div class="post-metadata">

**Author:** ![EisenbergEffect](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/eisenbergeffect/32/2655_2.png) [@EisenbergEffect](https://discourse.aurelia.io/u/EisenbergEffect)\
**Post date:** [April 8, 2019, 12:35pm UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/6 "2019-04-08T12:35:40Z")

</div>

I apologize to everyone here. I forgot to follow-up on this thread.

The concern that was raised was with Aurelia’s internal HTMLSanitizer. However, per our docs, we indicate that it’s only a dev version and should not be used in production. So, there’s not really a security issue. We’ve updated our docs to add further clarity and guidance on how to replace the sanitizer with a production-grade implementation. We’ve also shipped an update that prints a warning to the console when you use our sanitizer.

---

<div class="post-metadata">

**Author:** ![tomtomau](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/tomtomau/32/780_2.png) [@tomtomau](https://discourse.aurelia.io/u/tomtomau)\
**Post date:** [April 8, 2019, 8:33pm UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/7 "2019-04-08T20:33:07Z")

</div>

Thanks Rob.

For those playing along at home, here are the referred docs: [https://aurelia.io/docs/binding/basics#element-content](https://aurelia.io/docs/binding/basics#element-content)

---

<div class="post-metadata">

**Author:** ![huochunpeng](https://avatars.discourse-cdn.com/v4/letter/h/49beb7/32.png) [@huochunpeng](https://discourse.aurelia.io/u/huochunpeng)\
**Post date:** [April 10, 2019, 4:35am UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/8 "2019-04-10T04:35:13Z")

</div>

@fkleuver the doc should provide code snippet to enable DOMPurify or sanitize-html. I mean copy-paste ready code snippet.

---

<div class="post-metadata">

**Author:** ![Sayan751](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/sayan751/32/1861_2.png) [@Sayan751](https://discourse.aurelia.io/u/Sayan751)\
**Post date:** [April 10, 2019, 7:17am UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/9 "2019-04-10T07:17:29Z")

</div>

I have used `sanitize-html` package (justification: [https://www.npmtrends.com/sanitize-html-vs-dompurify](https://www.npmtrends.com/sanitize-html-vs-dompurify)) to have a rather simplistic value converter.

```javascript
import sanitizeHtml = require("sanitize-html");

export class SanitizeHtmlValueConverter {
  public toView(value: string) {
    return !!value ? sanitizeHtml(value) : "";
  }
}

```

And then used it as

```auto
<my-el innerhtml.bind="htmlString|sanitizeHtml"></my-el>

```

Is this good enough? Or am I missing something?

---

<div class="post-metadata">

**Author:** ![Sayan751](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/sayan751/32/1861_2.png) [@Sayan751](https://discourse.aurelia.io/u/Sayan751)\
**Post date:** [April 10, 2019, 7:46am UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/10 "2019-04-10T07:46:50Z")

</div>

The similar approach also works with a custom Sanitizer class.

```javascript
export class MyHtmlSanitizer extends HTMLSanitizer {
  public sanitize(input) {
    return !!input ? sanitizeHtml(input) : "";
  }
}

// and then register as 
aurelia.use.singleton(HTMLSanitizer, MyHtmlSanitizer)

```

However, I find the usage of a custom value converter to be less disruptive (limited scope).

---

<div class="post-metadata">

**Author:** ![fkleuver](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/fkleuver/32/994_2.png) [@fkleuver](https://discourse.aurelia.io/u/fkleuver)\
**Post date:** [May 15, 2019, 1:30pm UTC](https://discourse.aurelia.io/t/vulnerability-disclosure-contact/2390/11 "2019-05-15T13:30:11Z")

</div>

> However, I find the usage of a custom value converter to be less disruptive (limited scope).

Actually @Sayan751, your approach of registering the custom Sanitizer class is exactly what that particular extension point was meant for. You could say it’s way it was intended to be used.

Put it this way: we’re not including a proper sanitizer by default because it would drag in a dependency of non-negligible size for something that most people don’t use. The default class is little more than a stub in that sense.  
But if you do include such dependency, you might as well utilize it to the fullest by making it the default sanitizer. I cannot imagine many scenarios where you have the dependency included, but still want to use the framework default in a certain case.