[Bug] The Informatieveiligheid module leaks: three surfaces stay visible with the module off #648

New issue

Closed

opened 2026-07-22 16:36:10 +00:00 by brenno · 0 comments

brenno commented

2026-07-22 16:36:10 +00:00

Owner

To reproduce. Fresh install, or Instellingen → Uitbreidingen → Informatieveiligheid off. Open Instellingen.

1. The Checklists tab. SettingsSection.checklists (settings_dialog_sections.dart:30) is a full sidebar tab where you build reusable test templates. AppSettings.customChecklists has exactly one consumer: checklist_editor.dart:165, the editor for the checklist slide type — and that type is module-gated. With the module off you can create templates, name them, add tests, and never load one anywhere. Eleven sidebar tabs, and one of them does nothing.

2. "CVE opzoeken" and "Lokale CVE-database" in Beveiliging. settings_dialog_security.dart:81 onwards. CvePicker is instantiated in finding_editor.dart:339 and finding_wizard.dart:156 — both module-only. So with the module off, the Beveiliging tab offers to enable an online CVE lookup that has no entry point, and, on desktop, offers to download the full CVE List V5 — several hundred megabytes, over a gigabyte transiently on disk, a quarter of an hour — to power a search the user cannot open.

Nothing leaks by default here: allowCveLookup is false and the local database is opt-in. This is wasted surface and a bad offer, not a privacy failure.

3. The "Pentestrapportage (ontwerp)" docs tile. settings_dialog_docs.dart:196, pointing at docs/design/PENTEST_MIAUW.md — the module's own design document, listed with the module off.

The third one is a genuine judgement call, and I would argue against gating it. The docs reader is a transparency feature: the point is that anyone can read what this application is and how it was designed, without first switching something on. Hiding a design document is a different act from hiding a feature. If we gate this tile, the same logic reaches the whole Ontwerp group, and that ends with an application that discloses less the less you have enabled. My preference: leave tile 3 alone and fix 1 and 2. Recorded here so the decision is made deliberately rather than by omission.

What the fix looks like

Gate SettingsSection.checklists on infoSafetyRevealProvider. The section list is currently unconditional (SettingsSection.navItems), so this needs a reveal predicate per section — a small change, and one the online-storage module (#570) will want as well, since it has to hide storage surface the same way.
Gate the CVE blocks inside the Beveiliging tab, leaving the privacy check, online media and disk traces where they are. Beveiliging stays a general-purpose tab; only the two CVE sections move.
Keep the established rule: reveal when the content is already there. Someone who created checklist templates, or already downloaded the local CVE database, must still see and be able to remove them with the module off — otherwise a toggle silently orphans a gigabyte on disk with no route to reclaim it. Same trick as the MIAUW fields in presentation_info_dialog.dart:411.

Why it is worth doing separately from #570. It needs no module registry and touches no storage code. It is also the cheapest possible answer to "the interface is overwhelming for a new user": one sidebar tab and two settings blocks disappear for everyone who has not asked for pentest reporting, with nothing gained or lost in capability.

The Informatieveiligheid module hides seven slide types, seven command-palette commands, two menu items, the MIAUW deck template and the MIAUW fields in the presentation properties. Three surfaces were left behind. Each one is settings you can reach, fill in, and then not use, because the only place the result is consumed sits behind the module gate. **To reproduce.** Fresh install, or Instellingen → Uitbreidingen → Informatieveiligheid off. Open Instellingen. **1. The Checklists tab.** `SettingsSection.checklists` (`settings_dialog_sections.dart:30`) is a full sidebar tab where you build reusable test templates. `AppSettings.customChecklists` has exactly one consumer: `checklist_editor.dart:165`, the editor for the `checklist` slide type — and that type is module-gated. With the module off you can create templates, name them, add tests, and never load one anywhere. Eleven sidebar tabs, and one of them does nothing. **2. "CVE opzoeken" and "Lokale CVE-database" in Beveiliging.** `settings_dialog_security.dart:81` onwards. `CvePicker` is instantiated in `finding_editor.dart:339` and `finding_wizard.dart:156` — both module-only. So with the module off, the Beveiliging tab offers to enable an online CVE lookup that has no entry point, and, on desktop, offers to download the full CVE List V5 — several hundred megabytes, over a gigabyte transiently on disk, a quarter of an hour — to power a search the user cannot open. Nothing leaks by default here: `allowCveLookup` is false and the local database is opt-in. This is wasted surface and a bad offer, not a privacy failure. **3. The "Pentestrapportage (ontwerp)" docs tile.** `settings_dialog_docs.dart:196`, pointing at `docs/design/PENTEST_MIAUW.md` — the module's own design document, listed with the module off. **The third one is a genuine judgement call, and I would argue against gating it.** The docs reader is a transparency feature: the point is that anyone can read what this application is and how it was designed, without first switching something on. Hiding a design document is a different act from hiding a feature. If we gate this tile, the same logic reaches the whole *Ontwerp* group, and that ends with an application that discloses less the less you have enabled. My preference: leave tile 3 alone and fix 1 and 2. Recorded here so the decision is made deliberately rather than by omission. **What the fix looks like** - Gate `SettingsSection.checklists` on `infoSafetyRevealProvider`. The section list is currently unconditional (`SettingsSection.navItems`), so this needs a reveal predicate per section — a small change, and one the online-storage module (#570) will want as well, since it has to hide storage surface the same way. - Gate the CVE blocks inside the Beveiliging tab, leaving the privacy check, online media and disk traces where they are. Beveiliging stays a general-purpose tab; only the two CVE sections move. - Keep the established rule: **reveal when the content is already there.** Someone who created checklist templates, or already downloaded the local CVE database, must still see and be able to remove them with the module off — otherwise a toggle silently orphans a gigabyte on disk with no route to reclaim it. Same trick as the MIAUW fields in `presentation_info_dialog.dart:411`. **Why it is worth doing separately from #570.** It needs no module registry and touches no storage code. It is also the cheapest possible answer to "the interface is overwhelming for a new user": one sidebar tab and two settings blocks disappear for everyone who has not asked for pentest reporting, with nothing gained or lost in capability.

brenno added the

bug

triage

labels

2026-07-22 16:36:10 +00:00

brenno referenced this issue

2026-07-22 16:36:28 +00:00

[Feature] Online storage as an extension: off by default, so the interface starts quiet #570

brenno referenced this issue from a commit

2026-07-22 17:49:58 +00:00

fix(module): laat de drie achtergebleven oppervlakken meebewegen

brenno referenced this issue from a pull request that will close it,