Reporting a vulnerability

[maffelbaffel]

I reported a security vulnerability to [email protected] and submitted a security advisory on GitHub over a week ago. I haven't received any response from the Vue.js team. Could someone please review my advisory?

[posva]

Thanks for the report! For some reason I don't receive notifications from this, which is weird... I reviewed it and pointed out the solution. In the future, given the nature of the request, I would prefer to be booked for it, as it's an enterprise-level service that companies should pay for and I do take it seriously and spend the proper amount of time to check them.

[maffelbaffel]

Thank you for reviewing the report and providing a very helpful answer!

In the future, given the nature of the request, I would prefer to be booked for it, as it's an enterprise-level service that companies should pay for and I do take it seriously and spend the proper amount of time to check them.

Not sure if security reports should be enterprise-level services, but if thats the case it should be somehow reflected in SECURITY.md

[posva]

I believe the benefits should be for everybody (e.g. I will add that avoiding a splat in the middle of the path creates poor performance regex that can lead to denial of service), but given the popularity of vue-router, how little funding it has, and how CVEs are structured, I think companies should pay for it as a service because when a security vulnerability is reported, it should be checked quickly. In other words, I stop doing other things I'm working on to ensure there is no risk. But yeah, not sure how to make it work, I wished it was enforced somehow by GitHub...