Pulling resource for publicly write-able S3 bucket

[ArchAngelOfOld]

In list.js, you are pulling a gif from assets.okfn.org/images/icons/ajaxload-circle.gif. However assets.okfn.org is an s3 bucket that's misconfigured to be publicly write-able.

Because of this, an attacker can replace the ajaxload-circle.gif with something obscene.

Consider using an image that is hosted more securely.

[rufuspollock]

@ArchAngelOfOld thanks - we'll look into this.

[ArchAngelOfOld]

Cool - Additionally does okfn have a bug bounty program or responsible disclosure that I should report this to more officially? Or is this the best place?

[rufuspollock]

@ArchAngelOfOld not that i know of.

[amercader]

This is fixed now, thanks for flagging this @ArchAngelOfOld. For responsible disclosure of security issues please reach out to [email protected]. Cheers.