Security: Difference between revisions
Dan Polansky (talk | contribs) (Redirected page to Data security) |
Dan Polansky (talk | contribs) (be more specific about versions) |
||
| (7 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
# | As regards security of FreeMind, there are the following concerns: | ||
* [[Data security]] | |||
* General security other than data security | |||
The first concern is covered in a dedicated article, [[Data security]]. The rest of this page deals with the second concern. | |||
One item from [[Data security]] is relevant here: Since FreeMind 0.8.1, FreeMind uses a plugin architecture. In some software contexts, plugin architecture has been found to be a security concern. The latest releases without plugins are FreeMind 0.7.1 and FreeMind 0.7.1-XT. See also [[Plugin]]. | |||
Groovy script security is a topic that is covered at [[Scripting#Security]]. Especially unrestricted scripts from untrusted sources are genereally dangerous. There is a related bug report applying to scripts possibly escaping the FreeMind script restrictions: | |||
* [https://sourceforge.net/p/freemind/bugs/1309/ A malicious script can cause harm by escaping the security sandbox], 2026, sourceforge.net | |||
The restrictions are described at [[Scripting#Security]]. | |||
A security issue on parsing of mind map XML was reported for Freeplane. The issue was assessed for FreeMind: | |||
* [https://sourceforge.net/p/freemind/bugs/1311/ Freeplane security issue on parsing of mind map XML to be assessed for FreeMind], 2026, sourceforge.net | |||
Conclusion: the issue does not apply to FreeMind 1.0.1. In brief, FreeMind uses [[NanoXML]]/Lite while Freeplane uses NanoXML/Java, a much more heavier/larger parser. | |||
Outdated Java runtime is a possible security concern. FreeMind 0.9.0 and 1.0.1 are currently running on up to Java 23, but for Java 17 and later it needs a modified freemind.bat with a switch to allow the deprecated security manager. FreeMind 0.9.0 and 1.0.1 do not run on Java 24 since it disabled/permanently removed the SecurityManager class and the associated framework. See also [[Scripting#Security]]. | |||
[[Category:Documentation]] | |||
Latest revision as of 12:53, 27 August 2026
As regards security of FreeMind, there are the following concerns:
- Data security
- General security other than data security
The first concern is covered in a dedicated article, Data security. The rest of this page deals with the second concern.
One item from Data security is relevant here: Since FreeMind 0.8.1, FreeMind uses a plugin architecture. In some software contexts, plugin architecture has been found to be a security concern. The latest releases without plugins are FreeMind 0.7.1 and FreeMind 0.7.1-XT. See also Plugin.
Groovy script security is a topic that is covered at Scripting#Security. Especially unrestricted scripts from untrusted sources are genereally dangerous. There is a related bug report applying to scripts possibly escaping the FreeMind script restrictions:
- A malicious script can cause harm by escaping the security sandbox, 2026, sourceforge.net
The restrictions are described at Scripting#Security.
A security issue on parsing of mind map XML was reported for Freeplane. The issue was assessed for FreeMind:
- Freeplane security issue on parsing of mind map XML to be assessed for FreeMind, 2026, sourceforge.net
Conclusion: the issue does not apply to FreeMind 1.0.1. In brief, FreeMind uses NanoXML/Lite while Freeplane uses NanoXML/Java, a much more heavier/larger parser.
Outdated Java runtime is a possible security concern. FreeMind 0.9.0 and 1.0.1 are currently running on up to Java 23, but for Java 17 and later it needs a modified freemind.bat with a switch to allow the deprecated security manager. FreeMind 0.9.0 and 1.0.1 do not run on Java 24 since it disabled/permanently removed the SecurityManager class and the associated framework. See also Scripting#Security.
