Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Security page in Reporting docs #1475

Open
10 tasks done
ighristov opened this issue Sep 4, 2024 · 2 comments
Open
10 tasks done

Add Security page in Reporting docs #1475

ighristov opened this issue Sep 4, 2024 · 2 comments
Assignees
Labels

Comments

@ighristov
Copy link
Collaborator

ighristov commented Sep 4, 2024

DX BU KR: КR4: Public Security Documentation across the products
link to the template used in DX BU: Security Article Draft

Create a documentation page that will enumerate the recommended security settings for Reporting projects.
Populate the list below with more topics:

  • app configuration settings (assembly and types whitelisting, unsafe mode)
  • .trdx / .trdp definitions - guidance to ensure that report definitions come from trusted sources
  • type reports in .dlls - guidance to ensure that the .dll comes from trusted sources. For example, a bad agent may use remote code execution
  • rate-limiting in Reporting - responsibility of the client.
  • data connections must be with the least permissions.
  • data fetching can delete info from tables.
  • do not include connection strings and credentials in report files
  • It is your responsibility to Authorize Reporting REST API - ReportsController. The requests for resources are not authenticated by design
  • Web Designer - use https://docs.telerik.com/reporting/designing-reports/report-designer-tools/web-report-designer/customize-web-designer#fine-tune-the-customization-in-the-web-report-designer
  • Report Converters - need to explain that the clients need to ensure the reports they're converting to Telerik Reports, are safe.

Statement: if the client extends Reporting engine either with code or with configuration, he is responsible for securing it.

@todorarabadzhiev todorarabadzhiev self-assigned this Sep 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants