Commit 43b5a21
doc: add path.join and path.normalize clarification
This commit adds explicit clarification to the Node.js threat model
that path manipulation functions such as path.join() and
path.normalize()
trust their input. Issues related to these functions that rely on
unsanitized input are not considered vulnerabilities requiring CVEs.
PR-URL: #59262
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>1 parent 6aec5ae commit 43b5a21
1 file changed
Lines changed: 5 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -179,6 +179,11 @@ then untrusted input must not lead to arbitrary JavaScript code execution. | |||
| 179 | 179 | See <https://nodejs.org/api/modules.html#all-together>. | |
| 180 | 180 | * The `node:wasi` module does not currently provide the comprehensive file | |
| 181 | 181 | system security properties provided by some WASI runtimes. | |
| 182 | + * The execution path is trusted. Additionally, Node.js path manipulation functions | ||
| 183 | + such as `path.join()` and `path.normalize()` trust their input. Reports about issues | ||
| 184 | + related to these functions that rely on unsanitized input are not considered vulnerabilities | ||
| 185 | + requiring CVEs, as it's the user's responsibility to sanitize path inputs according to | ||
| 186 | + their security requirements. | ||
| 182 | 187 | ||
| 183 | 188 | Any unexpected behavior from the data manipulation from Node.js Internal | |
| 184 | 189 | functions may be considered a vulnerability if they are exploitable via | |
0 commit comments