NOTE: This article is an INTERNAL article and is not visible to customers, currently. Please only link this article in internal comments, but not public comments.
Issue
- The source map file for JS source code files can be obtained when loading a Liferay page or by requesting the appropriate URL.
- These source map files are useful in environments where the original source is minified, easing debugging tasks, for example.
- Is the availability of these .map files a security concern?
Environment
- Liferay DXP 7.0, 7.1, 7.2, 7.3, 7.4
Resolution
- In general, source map files don't represent a security concern. The OWASP mentions that:
It can make it easier for attackers to find vulnerabilities from the front-end or collect sensitive information from it.
Depending on the context and sensitivity of the project, a security expert should decide whether the files should exist in the production environment or not.
- In Liferay, the source code for the JS files
- is already open and available,
- does not include sensitive information.
- In summary, source map files do not represent a vulnerability issue in Liferay.