Skip to content

Browser "view source" exposes Backdrop and other version numbers when js aggregation is turned off #7179

Description

@swampopus

This isn't exactly a bug or even a security issue, so I wasn't sure how to label it or what kind of template to select for this issue.

The Problem

If you have JS Aggregation turned off, and click to "view source" of any page, even as an anonymous user, you can clearly see the Backdrop core version number.

See example:

Image

This has some future security implications, as if there's ever an exploit discovered that targets, for example, anything before version 1.50.2, then it would be that much easier for a bad actor to find Backdrop sites that were exploitable.

The Fix

Instead of adding the version numbers as part of the URL, they should get the same cache-break string added as the contrib CSS and JS files.

Ex: <script src="https://example.com/modules/contrib/devel/devel_krumo.js?t3t45p"></script>

The t3t45p is what I'm talking about at the end. It changes every time the Backdrop cache is cleared, which is fine while you're actively developing and working on your site.

If you have "aggregate JS / CSS" turned on, this occludes the version numbers.

Alternatives

As an alternative, on the Performance form, where you can disable JS and CSS aggregation, have a warning that if it is disabled, then there are some security implications. But to me this seems like it would lead to more confusion.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions