boost cache folder not security risk

Ok. Security Review could provide a whitelist but it basically informs you of anything that's writeable. It's not perfect so the check can be ignored. A whitelist makes sense to me until it becomes quite large.

Rather than maintaining a whitelist (or in addition?) we could also look for an htaccess file in the root of the directory with "SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006"

Boost creates/uses that just like core does for the sites/default/files directory.

greggles' suggestion sounds perfectly sensible... but then I thought: if a Drupal-savvy exploit was creating files where it shouldn't, wouldn't it be a trivial issue to create such an .htaccess file in the directory it was exploiting? So doesn't seem ideal.

The point of creating these files is to execute them. So, if an htaccess is there with that entry then we're all set anyway.

The only exploit I can imagine with an htaccess with that entry would be uploading a ton of "bad" files for distribution, which they could do in the files directory anyway.

How about I drupal_alter() the ignore list? Then Security Review doesn't have to add exceptions.

the .htaccess check should still happen.

Committed #5 http://drupalcode.org/project/security_review.git/commit/fb2d246 and http://drupalcode.org/project/security_review.git/commit/12b6b76