Skip to content

Commit aa31c70

Browse files
committed
chore: relocate tech debts fragment url
1 parent 10ecbdd commit aa31c70

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

docs/pages/changelog.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,8 @@ ACAP 2.0 is the latest ACAP version. Its latest stable version is Release/Tag ve
7272
Version 2.0 and later versions may have new requirements that will thrive on new development approaches loosely tied to the recommended [Security](/security) and [Server](/directories/server) guidelines of **ACAP 1.0**, requiring thorough testing and validation.
7373
</Callout>
7474

75-
<FAQBoxError title="💀 Version 2.0 - 2.1 Security Technical Debts">
7675
<div id="acap-2-security-debts" />
76+
<FAQBoxError title="💀 Version 2.0 - 2.1 Security Technical Debts">
7777
1. **Flexible Firestore Database Use:** ACAP version 2.0+ adopted a more flexible approach for handling data management, facilitating faster feature development by performing _<u>WRITE operations to the database directly from the web front end</u>_ coupled with more _<u>lenient Firestore database Rules</u>_. However, this shift also introduced the potential for data to enter the database without the usual front-end controls through the [Firestore REST APIs](https://cloud.google.com/firestore/docs/reference/rest/). While this was <u><b><i>not an issue in [Version 1.0](#version-1-acap-10)</i></b></u>, it emerged as part of the effort to enhance development speed and feature delivery <u><b><i>starting with Version 2.0</i></b></u>.
7878
2. **Cross-Site Scripting (XSS) Vulnerability in Crop Recommendations:** Related to item 1, the new process for editing WYSIWYG HTML-form crop recommendations input may allow unsafe or inaccurate content due to limited validation through the [Firestore REST APIs](https://cloud.google.com/firestore/docs/reference/rest/). Risks associated with this were recognized early in the process, but the focus on delivering core features led to a delay in integrating security measures.
7979
<AnchorModal

0 commit comments

Comments
 (0)