Plugin Security Standards

This document introduces the security requirements in plugin development, including specifications for handling sensitive data, input parameter security validation, etc.

Handling of Sensitive Data

Identification of Sensitive Data

The following types of data are considered sensitive:

• Identity authentication information (token, password, api-key, etc.)
• Personal identity information (name, email, phone number, etc.)
• Project confidential information (business plans, source code, etc.)
• System configuration information (database connection strings, etc.)

Handling Principles

1. Prohibit Hardcoding: It is strictly forbidden to hardcode sensitive information in the code.
2. Use Secure Input: Obtain sensitive data through secure input mechanisms.
3. Encrypted Storage: Sensitive data must be encrypted during storage and transmission.
4. Minimize Exposure: Expose sensitive data only when necessary.
5. Timely Cleanup: Clean up sensitive data in memory after use.

Code Examples

// Incorrect: Hardcoded token
const token = 'hardcoded-token-12345';

// Correct: Obtain token through secure input
const token = core.getInput('token');

// Clean up after use
function cleanupSensitiveData() {
  if (token) {
    token = null;
  }
}

Input Parameter Security Validation

All input parameters must be strictly validated:

Parameter Type	Validation Rules	Example
String	Length limit, format check	Email format, URL format
Number	Range check, type check	Positive numbers, negative number range limits
File	Path security check	Prevent path traversal attacks
List	Element validation, length limit	Maximum number of elements limit