Handling code with security issues in them?

Question

I've seen someone post a question with some code in it, with a really large security issue in it. I commented on the question that the security hole must be fixed, but I wonder how we should, more generally, be handling this type of issue.

A naive person may post code with such a problem in it, and also information to identify the site itself in the same post, which holds potential for disaster.

Even if the code in the question is fixed, the poster has still permanently advertised the problem to the world, meaning they haven't just left the door open, they've put up a big sign saying so as well.

Are there people "on their own", or should the community step up and take some level of responsibility here?

Answer 1

I saw that same question and it made me cringe.

A vague question trying to solve an issue seems fine, but I don't think this platform is appropriate to release known exploits or bugs.

I would argue that it's going to be different for each question asked. Down voting and flagging should generally peg the malicious questions quite quickly.

I do appreciate @ChrisF's answer in Dealing with questions of nefarious intent

A snippit from http://drupal.org/security-team

Disclosure policy The security team follows a Responsible Disclosure policy: we keep issues private until there is a fix OR until it becomes apparent that the maintainer is not addressing the issue in a timely manner. Public announcements are made when the threat has been addressed and a secure version is available. When reporting a security issue, observe the same policy. Do not share your knowledge of security issues with the public at large.

Answer 2

In the specific case, I would handle the website URL as if it was sensitive data, and I would follow What should I do when I put sensitive information in a post, and I need to remove them?

Truly, if the code containing the security issue is not custom code the user wrote for her/his own site, revealing a security issue with an existing module, or Drupal could cause problems also with other websites using that module, or Drupal. The case where the security issue is about Drupal, the risk of possible damage is higher, as it is enough to detect a website is using Drupal to try exploiting it.
That is the reason the Drupal.org security team doesn't want to make public a security issue without having a fix before.

What should be done for questions about security issues is probably consider them questions about bugs, and off-topic. There is nothing that can be done for bugs, if not opening an issue report in the right issue queue. That is the reason why questions about bugs are considered off-topic on Drupal Answers. If they would not be considered off-topic, they would be localized, as the question is useful until the bug is not fixed. Answering a question about a bug in a module hosted on Drupal.org doesn't make the bug disappear.