Commit a09f440
doc: add check for security reverts
- Add step to check that any PRs with breaking changes
have command line options to revert
- Add info on how to easily add command line option
to revert a breaking change related to a CVE
Signed-off-by: Michael Dawson <midawson@redhat.com>
PR-URL: #51376
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>1 parent 4c8fa3e commit a09f440
1 file changed
Lines changed: 50 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -75,6 +75,8 @@ The current security stewards are documented in the main Node.js | |||
| 75 | 75 | ||
| 76 | 76 | * [ ] Check that all vulnerabilities are ready for release integration: | |
| 77 | 77 | * PRs against all affected release lines or cherry-pick clean | |
| 78 | + * PRs with breaking changes have a | ||
| 79 | + [--security-revert](#Adding-a-security-revert-option) option if possible. | ||
| 78 | 80 | * Approved | |
| 79 | 81 | * (optional) Approved by the reporter | |
| 80 | 82 | * Build and send the binary to the reporter according to its architecture | |
@@ -223,6 +225,54 @@ out a better way, forward the email you receive to | |||
| 223 | 225 | [Security release stewards](https://github.com/nodejs/node/blob/HEAD/doc/contributing/security-release-process.md#security-release-stewards). | |
| 224 | 226 | If necessary add the next rotation of the steward rotation. | |
| 225 | 227 | ||
| 228 | + ## Adding a security revert option | ||
| 229 | + | ||
| 230 | + Breaking changes are allowed in existing LTS lines in order to fix | ||
| 231 | + important security vulnerabilities. When breaking changes are made | ||
| 232 | + it is important to provide a command line option that restores | ||
| 233 | + the original behaviour. | ||
| 234 | + | ||
| 235 | + The existing Node.js codebase supports the command line | ||
| 236 | + option `--security-revert` and has the boilerplate to make additions | ||
| 237 | + for a specific CVE easy. | ||
| 238 | + | ||
| 239 | + To add an option to revert for a CVE, for example `CVE-2024-1234` | ||
| 240 | + simply add this line to | ||
| 241 | + [`node_revert.h`](https://github.com/nodejs/node/blob/main/src/node_revert.h) | ||
| 242 | + | ||
| 243 | + ```c | ||
| 244 | + XX(CVE_2024_1234, "CVE-2024-1234", "Description of cve") | ||
| 245 | + ``` | ||
| 246 | + | ||
| 247 | + This will allow an easy check of whether a reversion has been | ||
| 248 | + requested or not. | ||
| 249 | + | ||
| 250 | + In JavaScript code you can check: | ||
| 251 | + | ||
| 252 | + ```js | ||
| 253 | + if (process.REVERT_CVE_2024_1234); | ||
| 254 | + ``` | ||
| 255 | + | ||
| 256 | + In C/C++ code you can check: | ||
| 257 | + | ||
| 258 | + ```c | ||
| 259 | + IsReverted(SECURITY_REVERT_CVE_2024_1234) | ||
| 260 | + ``` | ||
| 261 | + | ||
| 262 | + From the command line a user can request the revert by using | ||
| 263 | + the `--security-revert` option as follows: | ||
| 264 | + | ||
| 265 | + ```console | ||
| 266 | + node --security-revert=CVE-2024-1234 | ||
| 267 | + ``` | ||
| 268 | + | ||
| 269 | + If there are multiple security reverts then multiple instances | ||
| 270 | + of --security-revert can be used. For example: | ||
| 271 | + | ||
| 272 | + ```console | ||
| 273 | + node --security-revert=CVE-2024-1234 --security-revert=CVE-2024-XXXX | ||
| 274 | + ``` | ||
| 275 | + | ||
| 226 | 276 | ## When things go wrong | |
| 227 | 277 | ||
| 228 | 278 | ### Incomplete fixes | |
0 commit comments