From f5ff1a47f7368e3a33c627becbfff977aac35480 Mon Sep 17 00:00:00 2001 From: "Stephan T. Lavavej" Date: Tue, 14 May 2024 13:57:31 -0700 Subject: [PATCH 1/5] Delete old SECURITY.md. --- SECURITY.md | 46 ---------------------------------------------- 1 file changed, 46 deletions(-) delete mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md deleted file mode 100644 index 57fdc268902..00000000000 --- a/SECURITY.md +++ /dev/null @@ -1,46 +0,0 @@ - - -## Security - -Microsoft takes the security of our software products and services seriously, which includes all source code -repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), -[Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), -[Xamarin](https://github.com/xamarin), and [many more](https://opensource.microsoft.com/). - -If you believe you have found a security vulnerability in any Microsoft-owned repository that meets Microsoft's -[definition](https://docs.microsoft.com/en-us/previous-versions/tn-archive/cc751383(v=technet.10)) of a security -vulnerability, please report it to us as described below. - -## Reporting Security Issues - -**Please do not report security vulnerabilities through public GitHub issues.** Instead, please report them to the -Microsoft Security Response Center at [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your -message with our PGP key; please download it from the -[Microsoft Security Response Center PGP Key page](https://technet.microsoft.com/en-us/security/dn606155). - -You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we -received your original message. Additional information can be found at -[microsoft.com/msrc](https://www.microsoft.com/msrc). - -Please include the requested information listed below (as much as you can provide) to help us better understand the -nature and scope of the possible issue: - - * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) - * Full paths of source file(s) related to the manifestation of the issue - * The location of the affected source code (tag/branch/commit or direct URL) - * Any special configuration required to reproduce the issue - * Step-by-step instructions to reproduce the issue - * Proof-of-concept or exploit code (if possible) - * Impact of the issue, including how an attacker might exploit the issue - -This information will help us triage your report more quickly. - -## Preferred Languages - -We prefer all communications to be in English. - -## Policy - -Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://www.microsoft.com/en-us/msrc/cvd). - - From e7f8972ca874023cf7f89247324096fb5a636b0a Mon Sep 17 00:00:00 2001 From: "Stephan T. Lavavej" Date: Tue, 14 May 2024 13:58:01 -0700 Subject: [PATCH 2/5] Copy exactly SECURITY.md from microsoft/repo-templates. Source: https://github.com/microsoft/repo-templates/blob/672d188fc150e98870b86658bf15e1ae3dd07a2b/shared/SECURITY.md --- SECURITY.md | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000000..b3c89efc852 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,41 @@ + + +## Security + +Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet) and [Xamarin](https://github.com/xamarin). + +If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/security.md/definition), please report it to us as described below. + +## Reporting Security Issues + +**Please do not report security vulnerabilities through public GitHub issues.** + +Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/security.md/msrc/create-report). + +If you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/security.md/msrc/pgp). + +You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc). + +Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue: + + * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) + * Full paths of source file(s) related to the manifestation of the issue + * The location of the affected source code (tag/branch/commit or direct URL) + * Any special configuration required to reproduce the issue + * Step-by-step instructions to reproduce the issue + * Proof-of-concept or exploit code (if possible) + * Impact of the issue, including how an attacker might exploit the issue + +This information will help us triage your report more quickly. + +If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/security.md/msrc/bounty) page for more details about our active programs. + +## Preferred Languages + +We prefer all communications to be in English. + +## Policy + +Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/security.md/cvd). + + From 5dbc42f063b93148113cea1242eddb4d7cfdfa50 Mon Sep 17 00:00:00 2001 From: "Stephan T. Lavavej" Date: Tue, 14 May 2024 14:00:12 -0700 Subject: [PATCH 3/5] Copy exactly CODE_OF_CONDUCT.md from microsoft/repo-templates. Source: https://github.com/microsoft/repo-templates/blob/672d188fc150e98870b86658bf15e1ae3dd07a2b/shared/CODE_OF_CONDUCT.md --- CODE_OF_CONDUCT.md | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 CODE_OF_CONDUCT.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 00000000000..686e5e7a090 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,10 @@ +# Microsoft Open Source Code of Conduct + +This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). + +Resources: + +- [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/) +- [Microsoft Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) +- Contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with questions or concerns +- Employees can reach out at [aka.ms/opensource/moderation-support](https://aka.ms/opensource/moderation-support) From a2384e5ff5d2b7ef48c182a4f3711c82802e09ec Mon Sep 17 00:00:00 2001 From: "Stephan T. Lavavej" Date: Tue, 14 May 2024 14:18:46 -0700 Subject: [PATCH 4/5] Centralize on the newly added CODE_OF_CONDUCT.md. --- CONTRIBUTING.md | 4 ++-- README.md | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b3747e2b029..2001d4026bb 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -55,8 +55,8 @@ so we can determine whether the license is compatible and whether any other step # Code of Conduct This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). -For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or -contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. + +See [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for more information. [label:"good first issue"]: https://github.com/microsoft/STL/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22 diff --git a/README.md b/README.md index 0ac63dce717..984b5d460fc 100644 --- a/README.md +++ b/README.md @@ -512,8 +512,9 @@ See [CONTRIBUTING.md][] for more information. # Code Of Conduct -This project has adopted the [Microsoft Open Source Code of Conduct][]. For more information see the -[Code of Conduct FAQ][] or contact [opencode@microsoft.com][] with any additional questions or comments. +This project has adopted the [Microsoft Open Source Code of Conduct][]. + +See [CODE_OF_CONDUCT.md][] for more information. # License @@ -524,7 +525,7 @@ SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception [Changelog]: https://github.com/microsoft/STL/wiki/Changelog [clang-format]: https://clang.llvm.org/docs/ClangFormat.html [CMake]: https://cmake.org/download -[Code of Conduct FAQ]: https://opensource.microsoft.com/codeofconduct/faq/ +[CODE_OF_CONDUCT.md]: CODE_OF_CONDUCT.md [Compiler Explorer]: https://godbolt.org [CONTRIBUTING.md]: CONTRIBUTING.md [Developer Community]: https://aka.ms/feedback/report?space=62 @@ -555,6 +556,5 @@ SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception [libcxx]: https://libcxx.llvm.org [lit]: https://llvm.org/docs/CommandGuide/lit.html [lit result codes]: https://llvm.org/docs/CommandGuide/lit.html#test-status-results -[opencode@microsoft.com]: mailto:opencode@microsoft.com [redistributables]: https://learn.microsoft.com/en-US/cpp/windows/latest-supported-vc-redist [natvis documentation]: https://learn.microsoft.com/en-us/visualstudio/debugger/create-custom-views-of-native-objects From 37664f7edc478659c2c2cdf1db4761ee13456446 Mon Sep 17 00:00:00 2001 From: "Stephan T. Lavavej" Date: Tue, 14 May 2024 14:44:50 -0700 Subject: [PATCH 5/5] Skip validation of CODE_OF_CONDUCT.md and SECURITY.md. CODE_OF_CONDUCT.md contains LF line endings. SECURITY.md contains LF line endings. SECURITY.md contains 1 lines with trailing whitespace. SECURITY.md contains 7 lines with more than 120 columns. --- tools/validate/validate.cpp | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tools/validate/validate.cpp b/tools/validate/validate.cpp index 60b274e99cf..37e4dc78e64 100644 --- a/tools/validate/validate.cpp +++ b/tools/validate/validate.cpp @@ -212,6 +212,12 @@ int main() { L".obj"sv, }; + // CODE_OF_CONDUCT.md and SECURITY.md are copied exactly from https://github.com/microsoft/repo-templates + static constexpr array skipped_relative_paths{ + LR"(.\CODE_OF_CONDUCT.md)"sv, + LR"(.\SECURITY.md)"sv, + }; + // make sure someone doesn't accidentally include a diff in the tree static constexpr array bad_extensions{ L".diff"sv, @@ -228,6 +234,7 @@ int main() { static_assert(ranges::is_sorted(skipped_directories)); static_assert(ranges::is_sorted(skipped_extensions)); + static_assert(ranges::is_sorted(skipped_relative_paths)); static_assert(ranges::is_sorted(bad_extensions)); static_assert(ranges::is_sorted(tabby_filenames)); static_assert(ranges::is_sorted(tabby_extensions)); @@ -252,6 +259,10 @@ int main() { const wstring& relative_path = filepath.native(); + if (ranges::binary_search(skipped_relative_paths, relative_path)) { + continue; + } + constexpr size_t maximum_relative_path_length = 120; if (relative_path.size() > maximum_relative_path_length) { validation_failure(any_errors, filepath, "filepath is too long ({} characters; the limit is {}).",