# Vulnerability Management Policy

This document formally describes the process of addressing and managing a
reported vulnerability that has been found in the MinIO server code base,
any directly connected ecosystem component or a direct / indirect dependency
of the code base.

## Scope

The vulnerability management policy described in this document covers the
process of investigating, assessing and resolving a vulnerability report

import time

from fastapi import FastAPI, Request

app = FastAPI()


@app.middleware("http")
async def add_process_time_header(request: Request, call_next):
    start_time = time.time()
    response = await call_next(request)
    process_time = time.time() - start_time
    response.headers["X-Process-Time"] = str(process_time)

            restrictions.add(restriction);
            upperBound = restriction.getUpperBound();

            process = process.substring(index + 1).trim();

            if (process.startsWith(",")) {
                process = process.substring(1).trim();
            }
        }

        if (!process.isEmpty()) {
            if (!restrictions.isEmpty()) {
                throw new InvalidVersionSpecificationException(

            } else {
                logger.warn("Failed to process {}", id, e);
            }
        } catch (final Exception e) {
            logger.warn("Failed to process {}", id, e);
        }
        return false;
    }

    protected boolean process(final String id, final Predicate<ResponseData> consumer) {
        return process(id, (configId, url) -> {

### TLS with SNI Extension

**Only one process** in the server can be listening on a specific **port** in a specific **IP address**. There could be other processes listening on other ports in the same IP address, but only one for each combination of IP address and port.

TLS (HTTPS) uses the specific port `443` by default. So that's the port we would need.

- Primary security coordinator: ******@****.***
- Secondary coordinator: ******@****.***
- If you receive no response: ******@****.***

### Disclosure Process

MinIO uses the following disclosure process:

1. Once the security report is received one member of the security team tries to verify and reproduce
   the issue and determines the impact it has.

                    phase("generate-sources"),
                    phase("process-sources"),
                    phase("generate-resources"),
                    phase("process-resources"),
                    phase("compile"),
                    phase("process-classes"),
                    phase("generate-test-sources"),
                    phase("process-test-sources"),
                    phase("generate-test-resources"),

        "start_datetime": "2018-12-22T14:00:00+00:00",
        "end_datetime": "2018-12-24T15:00:00+00:00",
        "repeat_at": "15:30:00",
        "process_after": 300,
    }
    expected_response = data.copy()
    expected_response.update(
        {
            "start_process": "2018-12-22T14:05:00+00:00",
            "duration": 176_100,
            "item_id": item_id,
        }
    )

errors.login_error=Username or Password is not correct.
errors.sso_login_error=Failed to process SSO login.
errors.could_not_find_log_file=Could not find {0}.
errors.failed_to_start_crawl_process=Failed to start a crawl process.
errors.invalid_design_jsp_file_name=Invalid JSP file.
errors.design_jsp_file_does_not_exist=JSP file does not exist.

        try {
            Process process = new ProcessBuilder().command(args).start();
            CountDownLatch latch = new CountDownLatch(2);
            ByteArrayOutputStream stdout = connectStream(process.getInputStream(), latch);
            ByteArrayOutputStream stderr = connectStream(process.getErrorStream(), latch);

            process.waitFor(1, TimeUnit.MINUTES);