Commit b43ecf4
doc: trust FFI in the threat model
Signed-off-by: Paolo Insogna <paolo@cowtech.it>
PR-URL: #62852
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>1 parent 42e770b commit b43ecf4
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -213,7 +213,7 @@ then untrusted input must not lead to arbitrary JavaScript code execution. | |||
| 213 | 213 | along with anything under the control of the operating system. | |
| 214 | 214 | * The code it is asked to run, including JavaScript, WASM and native code, even | |
| 215 | 215 | if said code is dynamically loaded, e.g., all dependencies installed from the | |
| 216 | - npm registry. | ||
| 216 | + npm registry or libraries loaded via `node:ffi`. | ||
| 217 | 217 | The code run inherits all the privileges of the execution user. | |
| 218 | 218 | * Inputs provided to it by the code it is asked to run, as it is the | |
| 219 | 219 | responsibility of the application to perform the required input validations, | |
0 commit comments