Adam Daley
dd3dcbfd52
* Improve type safety, auth checks and PHPStan fixes (#3250) * Improve type safety, auth checks and PHPStan fixes * Remove @phpstan-ignore annotations * Improve type safety, auth checks and PHPStan fixes * Remove @phpstan-ignore annotations * Remove redundant @phpstan-ignore comment * Improve code robustness and reliability (#3248) * Harden code against null/undefined values * Update dependency lockfiles * Sanitize ticket input and use IDs in email list * Restructure tests and add test utilities * Move E2E tests to `Library\E2E` namespace * Update `php-build` action ref in workflows * Switch tests to Pest and add test scaffolding * Refactor E2E tests to Pest-style tests m Skip E2E tests when env not configured * Refactor Unit tests and update test config Add test datasets and refine test helpers * Add DEBUG guard, fix API JSON decode, update tests * Refactor tests: add types and Mockery expectations * Adjust tests, phpstan config, and composer script * Instantiate test APIs locally, remove beforeEach * Refactor runtime checks, types & logging * Apply PHP Code Styling Changes m * Add PHPStan ignores, test renames & small fixes * Enable Pest tests in CI workflow * Remove legacy tests; add new unit tests/config * Avoid undefined index in fingerprint comparison * Ignore properties absent in both fingerprints * Remove public_ticket_create API method * Add Fingerprint unit tests * Remove em dash from fingerprint test name * Switch to Pest; assorted bug fixes & refactors * Prefer getDi() and guard DEBUG define * Refactor tests: DBAL, Antispam rename, helpers * Refactor email tests to use Doctrine entities * Update tests, use DBAL mocks & improve Formbuilder admin * Validate plan_id and update unit tests * Replace error_log with DI logger and update tests * Expect db->store in Invoice Service test * Use DI logger instead of error_log; fix tests * Fix typo in Hook Service test * Fix Staff test spelling fixture * Complete Pest test migration * Fix Product test spelling fixtures * Fix Product test spelling fixtures * Run live tests with Pest and load helpers * Migrate tests to ApiClient; remove legacy APIHelper * Fix Email test spelling * Remove unused PHPUnit bridge * Organize Cypress end-to-end tests * Document Pest test directory root * Remove noisy Pest comments
2.0 KiB
Security Policy
Reporting Vulnerabilities
FOSSBilling accepts vulnerability reports directly through GitHub, to open a new one simply click here.
If you are looking for existing advisories, those can be found here on GitHub.
If you have a bug or a suggestion that is not related to an exploit, it should be reported via a new issue. (But please check if someone has already submitted it first!)
A well-written vulnerability report should include the following information:
- Identification of the file(s) affected by the exploit
- Description of how the vulnerability can be exploited
- Potential ramifications of the vulnerability
- A proof of concept exploit (if possible)
- Insights into a possible solution
Non-Qualifying Vulnerabilities
Reports covering any of the following topics will be rejected by the FOSSBilling team:
- Reports from automated tools or scanners.
- Theoretical attacks without proof of exploitability.
- Attacks that are the result of a third party library should be reported to the library maintainers.
- Social engineering.
- Reflected file download.
- Physical attacks.
- Weak SSL/TLS/SSH algorithms or protocols.
- Attacks involving physical access to a user’s device, or involving a device or network that’s already seriously compromised (eg man-in-the-middle).
- The user attacks themselves.
- Anything in
/tests.
A special note on AI tooling
While you are more than welcome to use AI as an additional tool for security research and development, we will never accept something that is fully AI due to the substantial issues in quality control and accuracy. AI is a tool and does not replace actual skill and understanding.
If you are unable to perform security research / development without the assistance of an AI, then please do not attempt to do so for the FOSSBilling project.