Skip to content

v1.3.5-alpha.2 #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
acaptutorials merged 1 commit into from
Feb 16, 2025
Merged

v1.3.5-alpha.2 #95

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion docs/pages/announcements/firebase-storage-2024.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,10 +148,14 @@ Yes. <u>Some of the latest core deliverables</u> implemented for ACAP in its [2.

This table shows the overall security criteria ensured and accounted for by ACAP's best practices in its recommended [security guidelines](/security).

<Callout type="error">
The reduced enforcement of **Cross-Site Scripting (XSS) protection** particularly affects the <u>WYSIWYG-form Crop Recommendations</u>, leading to a reproducible security vulnerability. A [detailed description](https://github.com/amia-cis/acap-v2/issues/34) is available in the parent **acap-v2** GitHub issues list, with a video demonstration available upon request.
</Callout>

| Criteria | Purpose | ACAP [1.0](/changelog/#version-1-acap-10) | ACAP [2.0](/changelog/#version-2-acap-20) |
| --- | --- | :---: | :---: |
| User authentication | Authorized, allowed, and predictable operations access to resources | ✅ | ✅ |
| Cross-Site Scripting (XSS) Protection | <u>Predictable billing</u>, reliable/authentic website information, <u>user information confidentiality</u>, predictable data manipulation / SMS sending, protection for <u>unvalidated writes that allow tampering with stored data</u>, impacting system reliability, protection for <u>injecting malicious scripts</u> that <u>steal user info</u> or <u>redirect users to phishing sites</u> (and protection for other uncontrolled scenarios that stem from XSS) | ✅ | ❌ |
| **Cross-Site Scripting (XSS) Protection** | <u>Predictable billing</u>, reliable/authentic website information, <u>user information confidentiality</u>, predictable data manipulation / SMS sending, protection for <u>unvalidated writes that allow tampering with stored data</u>, impacting system reliability, protection for <u>injecting malicious scripts</u> that <u>steal user info</u> or <u>redirect users to phishing sites</u> (and protection for other uncontrolled scenarios that stem from XSS) | ✅ | ❌ |
| Cloud storage protection | Authorized, allowed, and predictable operations access to storage, <u>predictable billing</u> | ✅ | ✅ |
| Database integrity | Accuracy, consistency, and <u>reliability</u> of data stored in a database and presented to users | ✅ | ❌ |
| Database protection | Authorized, allowed, and predictable operations access to the (Firestore) database, <u>predictable billing</u> | ✅ | ❌ |
Expand Down