The Platform.sh service has a protective blocking feature that, under certain circumstances, restricts access to web sites with security vulnerabilities. We use this partial blocking method to prevent exploitation of known security vulnerabilities.
The protective block is meant for high impact, low complexity attacks.
Outdated software often contains known vulnerabilities that can be exploited from the Internet. Sites that can be exploited are protected by Platform.sh. The system partially blocks access to these sites.
Platform.sh maintains a database of signatures of known security vulnerabilities in open-source software that are commonly deployed on our infrastructure. The security check only analyze known vulnerabilities in open-source projects like Drupal, Symfony or WordPress. It can’t examine customizations written by Platform.sh customers.
We analyze the code of your application:
- When you push new code to Git
- Regularly when new vulnerabilities are added to our database
If a vulnerability deemed as critical is detected in your application, Platform.sh is going to reject the Git push.
We run two types of blocks:
For production websites, we run a “partial block” that allows the site to stay mostly online. Depending on the nature of the vulnerability, parts of a request, such as a query string, cookies or any additional headers, may be removed from GET requests. All other requests may be blocked entirely - this could apply to logging in, form submission or product checkout.
For development websites, we run complete blocks, and the error message gives you detailed information about the vulnerability.
Unblocking is automated upon resolution of the security risk. The block is removed soon after a customer applies a security upgrade and removes the vulnerability.
The protective block is there to protect you against known vulnerabilities in the software you deploy on Platform.sh.
If nonetheless you want to opt out of the protective block, specify it in your
.platform.app.yaml like this:
preflight: enabled: false
You can also explicitly opt-out of a specific check like this:
preflight: enabled: true ignore_rules: [ "drupal:SA-CORE-2014-005" ]