Skip to content

Commit 097ef52

Browse files
sofiaoreissofiaoreis
committed
updating convention and docs
1 parent 0890e2b commit 097ef52

File tree

13 files changed

+326
-162
lines changed

13 files changed

+326
-162
lines changed

‎docs/assets/index-C6IzIce3.css

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎docs/assets/index-CPT1Z4_R.js renamed to ‎docs/assets/index-CFKOEWSV.js

Lines changed: 47 additions & 47 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/assets/index-DNSp1Evt.css

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/index.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@
1313
<meta property="og:type" content="website" />
1414
<meta property="og:image" content="" />
1515

16-
<script type="module" crossorigin src="/assets/index-CPT1Z4_R.js"></script>
17-
<link rel="stylesheet" crossorigin href="/assets/index-C6IzIce3.css">
16+
<script type="module" crossorigin src="/assets/index-CFKOEWSV.js"></script>
17+
<link rel="stylesheet" crossorigin href="/assets/index-DNSp1Evt.css">
1818
</head>
1919

2020
<body>

‎src/App.tsx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import BlogPage from "./pages/Blog";
1010
import Docs from "./pages/Docs";
1111
import DocsConvention from "./pages/DocsConvention";
1212
import DocsReference from "./pages/DocsReference";
13-
import DocsInstallation from "./pages/DocsInstallation";
13+
import DocsConfiguration from "./pages/DocsConfiguration";
1414
import NotFound from "./pages/NotFound";
1515

1616
const queryClient = new QueryClient();
@@ -29,7 +29,7 @@ const App = () => (
2929
<Route path="/docs" element={<Docs />} />
3030
<Route path="/docs/convention" element={<DocsConvention />} />
3131
<Route path="/docs/reference" element={<DocsReference />} />
32-
<Route path="/docs/installation" element={<DocsInstallation />} />
32+
<Route path="/docs/configuration" element={<DocsConfiguration />} />
3333
<Route path="*" element={<NotFound />} />
3434
</Routes>
3535
</BrowserRouter>

‎src/components/Convention.tsx

Lines changed: 228 additions & 64 deletions
Large diffs are not rendered by default.

‎src/components/DocsLayout.tsx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ const docSections: DocSection[] = [
2727
title: "Getting Started",
2828
links: [
2929
{ title: "Introduction", href: "/docs" },
30-
{ title: "Installation", href: "/docs/installation" }
30+
{ title: "Configuration", href: "/docs/configuration" }
3131
]
3232
},
3333
{
@@ -190,7 +190,7 @@ const DocsLayout = ({ children }: DocsLayoutProps) => {
190190
</aside>
191191

192192
{/* Main content */}
193-
<main className="flex-1 py-6 px-4 md:px-8 max-w-5xl mx-auto w-full">
193+
<main className="flex-1 px-4 md:px-8 max-w-5xl mx-auto w-full mt-6 md:mt-10">
194194
{children}
195195

196196
{/* Previous/Next navigation */}

‎src/components/Examples.tsx

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@ import { coldarkDark } from 'react-syntax-highlighter/dist/esm/styles/prism';
88
const examples = [
99
{
1010
id: "",
11-
title: "CVE-2012-0036 (before SECOM)",
11+
title: "BEFORE SECOM",
1212
code: `URL sanitize: reject URLs containing bad data
13+
1314
Protocols (IMAP, POP3 and SMTP) that use the path part of a URL in a
1415
decoded manner now use the new Curl_urldecode() function to reject URLs
1516
with embedded control codes (anything that is or decodes to a byte value
@@ -26,22 +27,21 @@ This flaw is considered a security vulnerability: CVE-2012-0036
2627
Security advisory at: http://curl.haxx.se/docs/adv_20120124.html
2728
2829
Reported by: Dan Fandrich`,
29-
explanation: "This commit message shows the documentation uses Curl_urldecode() to reject control‐code–embedded URLs in IMAP/POP3/SMTP, preventing command injection (CVE-2012-0036), links the advisory, and credits the reporter."
30-
},
30+
explanation: "Covers the What/Why/How succinctly but lacks SECOM framing: no vuln-fix: header, 75-word tri-section, weakness metadata, or attribution/footer fields. To be fully SECOM-compliant it needs the standardized header, per-weakness block, CVSS/severity, and formal “Reported-by/Reviewed-by/Signed-off-by” lines."
31+
},
3132
{
3233
id: "auth-improvement",
33-
title: "CVE-2012-0036 (after SECOM)",
34+
title: "AFTER SECOM",
3435
code: `vuln-fix: Sanitize URLs to reject malicious data (CVE-2012-0036)
3536
36-
Protocols (IMAP, POP3 and SMTP) that use the path part of a URL in a
37-
decoded manner now use the new Curl_urldecode() function to reject URLs
38-
with embedded control codes (anything that is or decodes to a byte value
39-
less than 32).
40-
URLs containing such codes could easily otherwise be used to do harm and
41-
allow users to do unintended actions with otherwise innocent tools and
42-
applications.
43-
Like for example using a URL like pop3://pop3.example.com/1%0d%0aDELE%201
44-
when the app wants a URL to get a mail and instead this would delete one.
37+
libcurl IMAP/POP3/SMTP parsers accepted URL-path bytes that decode
38+
to ASCII control characters, enabling attackers to smuggle extra
39+
protocol commands—e.g. pop3://host/1%0D%0ADELE%201—and perform
40+
unintended mail operations. Any application that forwards
41+
untrusted URLs could thus silently delete or alter messages.
42+
The fix routes path decoding through Curl_urldecode(), which
43+
aborts when a decoded byte < 0x20 and returns CURLE_URL_MALFORMAT,
44+
preventing the crafted request from ever reaching the server.
4545
4646
Weakness: CWE-89
4747
Severity: High
@@ -53,8 +53,8 @@ Signed-off-by: Daniel Stenberg ([email protected])
5353
5454
Resolves: #17940
5555
See also: #17937`,
56-
explanation: "This example shows how to document a new security feature that addresses a brute force vulnerability. It clearly describes the problem, impact, and solution."
57-
}
56+
explanation: "SECOM-compliant commit message. Uses the vuln-fix: header, concise What/Why/How body, and a weakness block with CWE, severity and report link."
57+
}
5858
];
5959

6060
const Examples = () => {
@@ -66,25 +66,25 @@ const Examples = () => {
6666
<section id="examples" className="py-16">
6767
<div className="container mx-auto px-4">
6868
<div className="max-w-3xl mx-auto mb-12 text-center">
69-
<h2 className="text-3xl font-bold mb-6">Example SECOM Messages</h2>
69+
<h2 className="text-3xl font-bold mb-6">Example</h2>
7070
<p className="text-lg text-muted-foreground">
71-
See how SECOM can be applied to different security scenarios with these practical examples.
71+
See how SECOM can improve an existing security commit message.
7272
</p>
7373
</div>
7474

7575
<div className="max-w-4xl mx-auto">
7676
<Tabs defaultValue={examples[0].id} value={selectedExample} onValueChange={setSelectedExample}>
77-
<TabsList className="grid w-full grid-cols-2 md:grid-cols-4">
77+
<TabsList className="grid w-full grid-cols-2 md:grid-cols-2">
7878
{examples.map(ex => (
7979
<TabsTrigger key={ex.id} value={ex.id}>{ex.title}</TabsTrigger>
8080
))}
8181
</TabsList>
8282

8383
<TabsContent value={currentExample.id} className="mt-6">
8484
<Card className="p-0 overflow-hidden">
85-
<div className="p-3 bg-secondary/50 border-b">
85+
{/* <div className="p-3 bg-secondary/50 border-b">
8686
<h3 className="font-medium">{currentExample.title}</h3>
87-
</div>
87+
</div> */}
8888
<SyntaxHighlighter
8989
language="markdown"
9090
style={coldarkDark}

‎src/components/Hero.tsx

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ const Hero = () => {
2020
</p>
2121
<div className="mt-10 flex items-center justify-center gap-x-6">
2222
<Button size="lg" className="flex items-center gap-2" asChild>
23-
<Link to="/convention">
23+
<Link to="/convention" className="text-white hover:text-blue-100">
2424
Get Started
2525
</Link>
2626
</Button>
@@ -50,14 +50,14 @@ const Hero = () => {
5050
<code>
5151
{`vuln-fix: Sanitize URLs to reject malicious data (CVE-2012-0036)
5252
53-
Protocols (IMAP, POP3 and SMTP) that use the path part of a URL
54-
in a decoded manner now use the new Curl_urldecode() function to
55-
reject URLs with embedded control codes (anything that is or decodes
56-
to a byte value less than 32). URLs containing such codes could easily
57-
otherwise be used to do harm and allow users to do unintended actions
58-
with otherwise innocent tools and applications. Like for example using
59-
a URL like pop3://pop3.example.com/1%0d%0aDELE%201 when the app wants
60-
// a URL to get a mail and instead this would delete one.
53+
libcurl IMAP/POP3/SMTP parsers accepted URL-path bytes that decode
54+
to ASCII control characters, enabling attackers to smuggle extra
55+
protocol commands—e.g. pop3://host/1%0D%0ADELE%201—and perform
56+
unintended mail operations. Any application that forwards
57+
untrusted URLs could thus silently delete or alter messages.
58+
The fix routes path decoding through Curl_urldecode(), which
59+
aborts when a decoded byte < 0x20 and returns CURLE_URL_MALFORMAT,
60+
preventing the crafted request from ever reaching the server.
6161
6262
Weakness: CWE-89
6363
Severity: High

‎src/pages/Docs.tsx

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ import DocsLayout from "@/components/DocsLayout";
33
const Docs = () => {
44
return (
55
<DocsLayout>
6-
<div className="space-y-6">
7-
<h1 className="text-4xl font-bold text-primary mb-6">SECOM Documentation</h1>
6+
<div className="space-y-6 pt-8 md:pt-12">
7+
<h1 className="text-4xl font-bold text-primary mb-10 mt-6">SECOM Documentation</h1>
88

99
<div className="text-lg text-muted-foreground mb-8">
1010
Comprehensive documentation for the SECOM convention, a standardized approach to security commit messages.
@@ -47,10 +47,10 @@ const Docs = () => {
4747
</p>
4848

4949
<ul>
50-
<li><a href="/docs/installation" className="text-primary hover:underline">Installation</a> - Set up SECOM in your development environment</li>
50+
<li><a href="/docs/configuration" className="text-primary hover:underline">Configuration</a> - Set up SECOM in your development environment</li>
5151
<li><a href="/docs/convention" className="text-primary hover:underline">Convention Overview</a> - Understand the full convention specification</li>
5252
<li><a href="/docs/reference" className="text-primary hover:underline">Reference Guide</a> - Explore example patterns and templates</li>
53-
<li><a href="https://tqrg.github.io/secomlint/" className="text-primary hover:underline" target="_blank" rel="noopener noreferrer">Linter Tool</a> - Check compliance with the convention</li>
53+
<li><a href="https://security-commits.org/secomlint/" className="text-primary hover:underline" target="_blank" rel="noopener noreferrer">Linter Tool</a> - Check compliance with the convention</li>
5454
</ul>
5555

5656
<div className="bg-muted p-4 rounded-md mt-8">

0 commit comments

Comments
 (0)