How do we handle questions or answers that include code with severe security issues? Ignoring them is certainly not an option.
A similar question has been asked and discussed before; as “Cupcake” points out precisely:
It would be irresponsible not to, because not only do you let the original poster walk off with vulnerable code, but any other user who stumbles across it may unknowingly just copy and paste the insecure code into their own applications.
But the outcome of the above mentioned and similar discussions isn't really satisfying. The existing means of Stack Overflow to react to this kind of problem are not appropriate.
- Giving verbose explainations in comments is really tedious, especially if you look at lots of posts, and have to point out the ever same security issues again and again.
- Also, a mere comment is not obvious enough. Occassional visitors don't read comments; they see a code block and copy/paste it, especially if it's an answer.
- Users who can't comment, and feel the obligation to “do something about it”, leave answers – which again would be deleted as irrelevant to the actual question. That's especially frustrating for new users who are motivated, but are insecure about the “dos and don'ts” of SO.
So, what to do?
I would propose an additional kind of flagging posts: If posted code has a severe security issue, it should be flagged as such. There flag should result be a big red warning icon/label near the code or at the top of the post.
Also, when the post is edited, the reviewer should be able to tell if the security issue was fixed. That's not trivial, but if we concetrate on severe issues (see below), it should be possible for an averagely skilled developer without too many false positives/negatives.
The security flagging mechanism should provide “template” answers for the most common security issues, as well as a textarea for a brief explaination if the others don't match.
The tricky part is to define what a severe security issue is. If we'd label just any minor issue, then
- awareness for the real big ones would be numbed down, and
- we would get caught in meta-discussions about the severity/impact of security problem. (Although – hey, this would be a nice cross-promotion for Security SE!)
Luckily, there are several existing approached to classifying security issues, so we don't have to reinvent the wheel.
An alternative to flagging posts would be to edit obvious issues directly. But that's not really a solution, either: Fixing an issue may be much harder than spotting it, many issues would remain unfixed. Also, a bad edit may “break” the original question, in that the problem to be discussed would disappear.