Skip to content

Commit 7b6fa26

Browse files
kendo-botkendo-bot
committed
Sync with Kendo UI Professional
1 parent 978c7d2 commit 7b6fa26

File tree

4 files changed

+173
-9
lines changed

4 files changed

+173
-9
lines changed

‎docs/_config.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,9 @@ navigation:
338338
"accessibility":
339339
title: "Accessibility"
340340
position: 11
341+
"security":
342+
title: "Security"
343+
position: 12
341344
"jsp":
342345
title: "Progress<sup>®</sup> Telerik<sup>®</sup> UI for JSP"
343346
position: 20

‎docs/intro/widget-basics/security-and-validation.md‎ renamed to ‎docs/security/security-and-validation.md‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
11
---
2-
title: Security and Validation
3-
page_title: Security and Validation - Working with Components
2+
title: Useful Tips
3+
page_title: Security and Validation Useful Tips
44
description: "Get started with Kendo UI for jQuery and learn the fundamentals for XSS and CSRF attacks."
55
slug: kendoui_security_gettingstarted
6-
position: 60
6+
previous_url: /intro/widget-basics/security-and-validation
7+
published: True
8+
position: 2
79
---
810

9-
# Security and Validation
11+
# Security and Validation Useful Tips
1012

1113
Preventing Cross-site scripting (XSS) and implementing validation for Cross-Site Request Forgery(CSRF) tokens can significantly boost the security of the application and prevent malicious script execution.
1214

@@ -86,8 +88,3 @@ The following examples demonstrate the steps for implementing the CSRF token val
8688
}
8789
8890
```
89-
90-
## See Also
91-
92-
* [Creating Custom Components]({% slug createcustomkendouiwidgets_gettingstarted %})
93-
* [Getting Up and Running with Kendo UI (Guide)]({% slug getting_started_installation_kendoui %})

‎docs/security/security-faq.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
title: FAQ
3+
page_title: FAQ
4+
description: "Find answers to common questions about securing Kendo UI for jQuery controls, including how to report vulnerabilities, handle third-party dependencies, and receive security fixes."
5+
slug: security/security-faq
6+
tags: telerik, kendoui, jquery, security
7+
published: True
8+
position: 3
9+
---
10+
11+
# Frequently Asked Questions (FAQ)
12+
13+
In this article, you will find essential information and resources to help you secure Kendo UI for jQuery components. Whether you need to report vulnerabilities, manage third-party dependencies, or understand how security fixes are delivered, this FAQ provides clear guidance on our security processes. Explore best practices and learn how Progress ensures the highest level of security for its products, from vulnerability reporting to compliance with industry standards.
14+
15+
## How can I submit a security vulnerability report?
16+
17+
If you have identified a potential security vulnerability in a Telerik or Kendo UI product, you can report it through the following channels:
18+
19+
- **For Progress Customers**: Submit a security report by opening a support ticket through the [Technical Support Center](https://www.telerik.com/account/support-center). Provide detailed information, including the steps to reproduce the issue and any relevant reports or screenshots.
20+
21+
- **For Security Researchers**: Ethical hackers and security researchers can report vulnerabilities through our [Bugcrowd Vulnerability Disclosure Program](https://bugcrowd.com/engagements/whatsupgold-vdp). This platform ensures that security issues are addressed efficiently and transparently.
22+
23+
We will review the report and follow up in line with our security processes, making every effort to resolve confirmed vulnerabilities in a timely manner.
24+
25+
---
26+
27+
## What if I use a third-party scanning tool and want an assessment from Progress Telerik?
28+
29+
You can open a support ticket through the [Technical Support Center](https://www.telerik.com/account/support-center) for the respective product and submit detailed information, including scan reports (PDF/Word/Excel/Screenshot) triggered against a no-minified version of the scripts and steps to reproduce or evidence of the issue. Our team will review and respond accordingly. We treat Security Vulnerability reports with **highest priority** and we engage with our internal Security Champions for revisions.
30+
31+
> Tip: We recommend running the scan against the latest product version, as the problem may have already been resolved.
32+
33+
---
34+
35+
## What is Progress's policy on handling third-party dependencies?
36+
37+
Progress uses leading commercial tools to automatically monitor and update third-party dependencies in our Telerik and Kendo GitHub projects. Alerts are set up for all GitHub-hosted products, and any identified vulnerable dependencies are addressed by the repository owners and our dedicated security team.
38+
39+
Note: Our definition of "done" includes successful builds that are scanned using top security scanning tools, and the resolution of any security alerts.
40+
41+
---
42+
43+
## Is security integrated into the CI pipeline?
44+
45+
Yes, for example, our CI builds are integrated with some of the leading security scanning tools to ensure that new code commits do not introduce vulnerabilities or insecure code.
46+
47+
---
48+
49+
## How does Progress prioritize security reports?
50+
51+
We prioritize security vulnerability reports with the highest urgency. When we receive an inquiry or vulnerability report, we begin by analyzing the issue to determine whether it's a false positive or a valid concern. If the report is confirmed as valid, we assess its severity using the CVSS (Common Vulnerability Scoring System) and promptly release a patch based on the severity level.
52+
53+
---
54+
55+
## How are security fixes shipped?
56+
57+
Security fixes are typically included in the next product release. Similar to the bugfixes policy, we maintain and commit to support the latest version of the product. That said, if you want to benefit from a security fix, you would need to upgrade to the version where the fix exists.
58+
59+
---
60+
61+
## How will I be notified about security fixes?
62+
63+
Once a vulnerability is fixed, we aim to release a patched version of the product. Depending on the severity of the issue, we may notify customers through CVE publications, email, blog posts, KB articles, or Release Notes for the specific product.
64+
65+
---
66+
67+
## Does Progress/Telerik have any security certifications or accreditations, such as SOC 2 or other industry-recognized standards?
68+
69+
Yes, Progress and DevTools products perform annual SOC 2 compliance, which validates our commitment to security, confidentiality, and privacy. You can find more information about our compliance on the [Progress Trust Center](https://www.progress.com/trust-center). Additionally, we align our security practices with industry-leading frameworks to maintain and continually improve our high security standards.
70+
71+
72+

‎docs/security/security-information.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
title: Overview
3+
page_title: Overview
4+
description: "Learn how to secure Kendo UI for jQuery components and your web application with best practices, vulnerability reporting, and component-specific security guidelines."
5+
slug: security/security-information
6+
tags: kendoui, html, js, jquery, security, xss, owasp, csp
7+
published: True
8+
position: 1
9+
---
10+
11+
# Security
12+
13+
In today's world, security is more critical than ever. At Progress, we prioritize our customers' security, ensuring that our products are built with a strong foundation to safeguard their data and operations. We are committed to identifying and addressing potential vulnerabilities to provide our clients with the highest level of protection and confidence in our products.
14+
15+
## Purpose of this Article
16+
17+
This article covers common security-related questions, best practices, and the tools and processes we use to ensure the security of our products. It also outlines how customers and security researchers can report security issues, including our processes to mitigate risks. We provide guidance for submitting security reports through technical support or Bugcrowd, ensuring a clear pathway for identifying and addressing security concerns.
18+
19+
## Reporting Security Vulnerabilities
20+
21+
Whether you're a customer encountering an issue or a security researcher, we have processes to ensure a swift response and evaluation. Below are the steps for Progress customers and security researchers to report potential security vulnerabilities:
22+
23+
### For Progress Customers
24+
25+
At Progress, we work diligently to identify and fix security vulnerabilities in our products. Customers who believe they have identified a security issue should contact Technical Support for an evaluation. This allows us to document the issue and have our engineering teams confirm and address it as needed. Customers can submit reports through our support center:
26+
- [Technical Support](https://www.telerik.com/account/support-center)
27+
- [Contact Us](https://www.telerik.com/account/support-center/contact-us/technical-support)
28+
29+
### For Security Researchers
30+
31+
We value the contributions of security researchers and ethical hackers. If a researcher identifies a potential vulnerability, they can submit it via our [Bugcrowd](#) platform. We aim to meet the following response times:
32+
33+
| Type of Response | SLO (in business days) |
34+
|------------------|------------------------|
35+
| First Response | 7 days |
36+
| Time to Triage | 10 days |
37+
| Time to Resolution| Depends on severity |
38+
39+
For more information, visit:
40+
- [Bugcrowd Vulnerability Disclosure Program](https://bugcrowd.com/engagements/devtools-vdp)
41+
- [Progress Trust Center](https://www.progress.com/trust-center)
42+
- [Vulnerability Reporting Policy](https://www.progress.com/trust-center/vulnerability-reporting-policy)
43+
44+
45+
## What We Do to Mitigate Risk
46+
47+
Our dedicated security team, comprised of experienced developers and security experts—our "Security Champions"—reviews all web, desktop, and mobile products technologies for potential vulnerabilities. These vulnerabilities may be internally identified, reported by third-party tools, or flagged externally.
48+
49+
We actively manage the following strategies to mitigate risks:
50+
51+
### Prevention
52+
53+
Our primary goal is to prevent security issues before product delivery. We use the following prevention techniques:
54+
55+
- **Internal Logging**: Every potential security issue is logged, researched, tested, and verified. Issues deemed valid are assessed using a CVSS score, with critical issues prioritized.
56+
- **Third-Party Static Analysis Testing**: We utilize some of the leading security scanning tools in the market to scan for vulnerabilities in our software code. Regular scans are conducted, and results are reviewed to address vulnerabilities and mitigate false positives.
57+
58+
59+
## Third-Party Dependencies Handling
60+
61+
We leverage leading commercial tools to automatically monitor and update third-party dependencies in our Telerik and Kendo GitHub projects, ensuring they remain secure and up-to-date. Alerts are enabled for all GitHub-hosted products, and the identified vulnerable dependencies are addressed by the repository code owners and security champions.
62+
63+
>Note: Our definition of "Done" includes successful builds that are scanned using top security scanning tools, and the resolution of any security alerts.
64+
65+
66+
## Content Security Compliance
67+
68+
Content Security Policy (CSP) is a critical security measure that helps detect and mitigate the risks of content injection vulnerabilities, such as cross-site scripting (XSS) and data injection attacks. Telerik and Kendo UI components are designed to be CSP-compliant, ensuring secure integration into customer projects.
69+
70+
For more detailed information on CSP compliance for Kendo UI for jQuery, refer to the following article:
71+
- [Kendo UI for jQuery - Content Security Policy](https://docs.telerik.com/kendo-ui/intro/widget-basics/content-security-policy) - This resource provides guidelines on how to configure your web application to comply with CSP requirements when using Kendo UI for jQuery components.
72+
73+
The [`Kendo UI for jQuery R1 2023 release`](https://www.telerik.com/support/whats-new/kendo-ui/release-history/kendo-ui-r1-2023-(version-2023-1-117)) addresses the content security policy issues related to the `usafe-eval` directive for all its components except for the Spreadsheet.
74+
75+
More detailed information on Content Security Policy (CSP) Templates for Kendo UI for jQuery, you can find at the following article:
76+
- [Kendo UI for jQuery - Content Security Policy](https://docs.telerik.com/kendo-ui/intro/widget-basics/content-security-policy) - This guide demonstrates how to define `single-line functional CSP templates`, also `specify CSP templates with simple operations and complex logic`, as well as `convert existing templates into CSP-compatible ones`.
77+
78+
79+
## OWASP Top 10 Alignment
80+
81+
We closely monitor the [OWASP Top 10](https://owasp.org/www-project-top-ten/) list of security risks and align our security practices with these industry-leading standards. Regular updates ensure that our products address evolving security threats and vulnerabilities.
82+
83+
## Kendo UI Component-Specific Security Guidelines
84+
85+
Kendo UI for jQuery has a dedicated security-related article with security tips for individual components and general cross-site scripting (XSS) prevention tips. The article outlines best practices and recommendations for securing the components and mitigating potential risks.
86+
87+
The following article lists practical security tips for specific conponents.
88+
89+
- [General Security Best Practices and Useful Tips for Kendo UI for jQuery components](https://docs.telerik.com/kendo-ui/security/security-and-validation)
90+
91+
For more detailed answers to common security-related questions, please refer to our [Security FAQ page]({%slug security/security-faq%}).
92+

0 commit comments

Comments
 (0)