Sourcemap sensitive files leaked

Product Support

AI-generated summary

A discussion on the Discourse forum addresses a HackenProof bounty claiming that sourcemap files on a Discourse site could leak sensitive information. Rob_Tsai seeks clarification on whether the issue is valid, noting no relevant fix in the latest release. pfaffman dismisses the concern, arguing there is no non-public API and that the reported vulnerability may be part of security spam. MikeNolan agrees, suggesting some reports may be attempts to sell consulting services, while merefield adds sarcasm about the absurdity of such claims given Discourse’s open-source nature. Rob_Tsai thanks the community for their input, still uncertain about the validity of the issue.

1

Hi we got a HackenProof bounty about our Discourse site. We have upgrade to v3.10.beta3 +155 but didn’t see anything relevant in the release notes that is relevant to the bounty reported to us. Is this something new or not of concern?

Impact

The danger is that the attacker obtains the source code and sensitive information , and non-public api

Recommendation

The temporary solution is to delete the .map file in the code directory; The permanent solution is to disable the function of generating map files during build

I think you can refer to this link https://docs.fluidattacks.com/criteria/vulnerabilities/236/

2

I think the answer is that there is no non-public API. It’s documented at GitHub - discourse/discourse: A platform for community discussion. Free, open, simple. · GitHub and if you don’t know how to read that, you can always Reverse engineer the Discourse API.

I really hate bogus security spam.

3

I’m not sure they’re all bogus, but more than a few of them seem like they’re trolling for consulting projects. (But Big Eight accounting firms do that, too, and what they’re usually selling you is a pre-paid report which they revise slightly and charge you $20K.)

4

Thanks for your feedback. I wasn’t sure if this is truly is an issue.

5

Imagine fishing for a consulting project on the basis of warning someone their source code has leaked … and the site is built on one of the most famous open source projects in existence :sweat_smile:

6

Yeah, but every time one of these things arrives, I get an email from the executive director asking if this is something to worry about, even though I’m officially retired.