meta: clarify the threat model to explain the JSON.parse case · nodejs/node@2c95f6e · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 635
• Pull requests 756
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit 2c95f6e

Browse filesBrowse the repository at this point in the historyBrowse files

mcollina

authored and

RafaelGSS

committed

meta: clarify the threat model to explain the JSON.parse case

Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #47276 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

1 parent b0809a7 commit 2c95f6e
Copy full SHA for 2c95f6e

1 file changed

+4-2Lines changed: 4 additions & 2 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• SECURITY.md

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎SECURITY.md‎

Copy file name to clipboardExpand all lines: SECURITY.md

+4-2Lines changed: 4 additions & 2 deletions

• Display the source diff
• Display the rich diff

Original file line number	Diff line number	Diff line change
@@ -116,15 +116,17 @@ lead to a loss of confidentiality, integrity, or availability.
116	116	npm registry.
117	117	The code run inherits all the privileges of the execution user.
118	118	4. Inputs provided to it by the code it is asked to run, as it is the
119		- responsibility of the application to perform the required input validations.
	119	+ responsibility of the application to perform the required input validations,
	120	+ e.g. the input to `JSON.parse()`.
120	121	5. Any connection used for inspector (debugger protocol) regardless of being
121	122	opened by command line options or Node.js APIs, and regardless of the remote
122	123	end being on the local machine or remote.
123	124	6. The file system when requiring a module.
124	125	See <https://nodejs.org/api/modules.html#all-together>.
125	126
126	127	Any unexpected behavior from the data manipulation from Node.js Internal
127		- functions are considered a vulnerability.
	128	+ functions may be considered a vulnerability if they are expoitable via
	129	+ untrusted resources.
128	130
129	131	In addition to addressing vulnerabilities based on the above, the project works
130	132	to avoid APIs and internal implementations that make it "easy" for application

0 commit comments

Comments

0 (0)