Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 59 additions & 0 deletions .github/ISSUE_TEMPLATE/wall-of-fame.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
name: CodeQL Wall of Fame submission
description: Propose an entry to the CodeQL Wall of Fame (https://securitylab.github.com/codeql-wall-of-fame)
title: "[wall-of-fame]: <short description>"
labels: [wall-of-fame]
body:
- type: markdown
attributes:
value: |
# Welcome!

Thank you for submitting an entry for the CodeQL Wall of Fame!

# Details
- type: input
id: date
attributes:
label: Date
description: Publication date of the blog post, in YYYY-MM-DD format
placeholder: |
ex. 2023-01-01
validations:
required: true
- type: input
id: title
attributes:
label: Title
description: Title of the blog post
validations:
required: true
- type: input
id: author
attributes:
label: Author
description: Author of the blog post
validations:
required: true
- type: input
id: url
attributes:
label: URL
description: URL of the blog post
validations:
required: true
- type: input
id: cve
attributes:
label: CVE
description: CVE ID(s), comma separated
placeholder: |
ex. CVE-2023-0001, CVE-2023-0002
validations:
required: true
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be optional? We can accept submissions for non-CVE vulnerabilities and later decide if we should put them in the wall of fame

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was asking myself the same question.
For the time being, I decided to add the CVE as a hard requirement:

  • to limit dummy submissions,
  • to avoid too much review time,
  • to avoid the subjective selection from our part. As you said, without the CVE we'll have to decide which one is eligible or not ...

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reckon that we ourselves don't have CVEs for all (the ReDoS for example)

- type: textarea
id: description
attributes:
label: description
description: Short summary of the blog post
validations:
required: true