This isn't exactly a bug or even a security issue, so I wasn't sure how to label it or what kind of template to select for this issue.
The Problem
If you have JS Aggregation turned off, and click to "view source" of any page, even as an anonymous user, you can clearly see the Backdrop core version number.
See example:
This has some future security implications, as if there's ever an exploit discovered that targets, for example, anything before version 1.50.2, then it would be that much easier for a bad actor to find Backdrop sites that were exploitable.
The Fix
Instead of adding the version numbers as part of the URL, they should get the same cache-break string added as the contrib CSS and JS files.
Ex: <script src="https://example.com/modules/contrib/devel/devel_krumo.js?t3t45p"></script>
The t3t45p is what I'm talking about at the end. It changes every time the Backdrop cache is cleared, which is fine while you're actively developing and working on your site.
If you have "aggregate JS / CSS" turned on, this occludes the version numbers.
Alternatives
As an alternative, on the Performance form, where you can disable JS and CSS aggregation, have a warning that if it is disabled, then there are some security implications. But to me this seems like it would lead to more confusion.
This isn't exactly a bug or even a security issue, so I wasn't sure how to label it or what kind of template to select for this issue.
The Problem
If you have JS Aggregation turned off, and click to "view source" of any page, even as an anonymous user, you can clearly see the Backdrop core version number.
See example:
This has some future security implications, as if there's ever an exploit discovered that targets, for example, anything before version 1.50.2, then it would be that much easier for a bad actor to find Backdrop sites that were exploitable.
The Fix
Instead of adding the version numbers as part of the URL, they should get the same cache-break string added as the contrib CSS and JS files.
Ex:
<script src="https://example.com/modules/contrib/devel/devel_krumo.js?t3t45p"></script>The
t3t45pis what I'm talking about at the end. It changes every time the Backdrop cache is cleared, which is fine while you're actively developing and working on your site.If you have "aggregate JS / CSS" turned on, this occludes the version numbers.
Alternatives
As an alternative, on the Performance form, where you can disable JS and CSS aggregation, have a warning that if it is disabled, then there are some security implications. But to me this seems like it would lead to more confusion.