mirror of
https://github.com/MrAle98/sliver
synced 2026-06-08 11:54:46 +00:00
moloch--
39 lines
2.0 KiB
Markdown
39 lines
2.0 KiB
Markdown
Contributing to Sliver
|
|
======================
|
|
|
|
## General
|
|
|
|
* Contributions to core code must be GPLv3 (but not libraries)
|
|
* If you'd like to work on a feature, please open a ticket and assign it to yourself
|
|
* Changes should be made in a new branch
|
|
* Commits [must be signed](https://docs.github.com/en/github/authenticating-to-github/signing-commits) for any PR to master
|
|
* Please provide meaningful commit messages
|
|
* Ensure code passes existing unit tests, or provide updated test(s)
|
|
* `gofmt` your code
|
|
* Any changes to `vendor/` should be in a distinct commit
|
|
* Avoid use of `CGO` (limits cross-platform support)
|
|
* Avoid use of empty interfaces
|
|
* Never import anything from the `server` package in the `client` package.
|
|
|
|
## Security
|
|
|
|
* _Never_ trust the user, applied in a common-sense way.
|
|
* __Secure by default__, please ensure any contributed code follows this methodology to the best of your ability. It should be difficult to insecurely configure features/servers.
|
|
- It is better to fail securely than operate in an insecure manner.
|
|
* _Avoid_ incorporating user controlled values when constructing file/directory paths. Ensure any values that must be incorporated into paths are properly canonicalized.
|
|
* _Never_ use homegrown or non-peer reviewed encryption or random number generation algorithms.
|
|
* Whenever possible, use the following algorithms/encryption modes:
|
|
- AES-GCM-256
|
|
- SHA2-256 / HMAC-SHA2-256 or higher (e.g. SHA2-384)
|
|
- Curves P521, P384, P256
|
|
- Curve25519, XSalsa20, and Poly1305 (Nacl)
|
|
- ChaCha20Poly1305
|
|
* _Never_ use the following in a security context, and _avoid_ use even in a non-security context:
|
|
- MD5
|
|
- SHA1
|
|
- AES-ECB
|
|
- AES-CBC, AES-CTR, etc. -without use case justification
|
|
* `math/random` should _always_ be imported as `insecureRand` and _never_ used to generate values related to a security context.
|
|
* Always apply the most restrictive file permissions possible.
|
|
* Apply obfuscation techniques when possible, but _do not rely upon_ obfuscation for security.
|