Commit f088ce2
doc: update threat model based on discussions
Signed-off-by: Michael Dawson <mdawson@devrus.com>
PR-URL: #46373
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>1 parent 9bb0852 commit f088ce2
1 file changed
Lines changed: 21 additions & 6 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -82,14 +82,22 @@ Vulnerabilities related to this case may be fixed by a documentation update. | |||
| 82 | 82 | ||
| 83 | 83 | **Node.js does NOT trust**: | |
| 84 | 84 | ||
| 85 | - 1. The data from network connections that are created through the use of Node.js | ||
| 86 | - APIs and which is transformed/validated by Node.js before being passed to the | ||
| 87 | - application. This includes: | ||
| 88 | - * HTTP APIs (all flavors) client and server APIs. | ||
| 85 | + 1. Data received from the remote end of inbound network connections | ||
| 86 | + that are accepted through the use of Node.js APIs and | ||
| 87 | + which is transformed/validated by Node.js before being passed | ||
| 88 | + to the application. This includes: | ||
| 89 | + * HTTP APIs (all flavors) server APIs. | ||
| 90 | + 2. The data received from the remote end of outbound network connections | ||
| 91 | + that are created through the use of Node.js APIs and | ||
| 92 | + which is transformed/validated by Node.js before being passed | ||
| 93 | + to the application EXCEPT in respect to payload length. Node.js trusts | ||
| 94 | + that applications make connections/requests which will avoid payload | ||
| 95 | + sizes that will result in a Denial of Service. | ||
| 96 | + * HTTP APIs (all flavors) client APIs. | ||
| 89 | 97 | * DNS APIs. | |
| 90 | - 2. Consumers of data protected through the use of Node.js APIs (for example | ||
| 98 | + 3. Consumers of data protected through the use of Node.js APIs (for example | ||
| 91 | 99 | people who have access to data encrypted through the Node.js crypto APIs). | |
| 92 | - 3. The file content or other I/O that is opened for reading or writing by the | ||
| 100 | + 4. The file content or other I/O that is opened for reading or writing by the | ||
| 93 | 101 | use of Node.js APIs (ex: stdin, stdout, stderr). | |
| 94 | 102 | ||
| 95 | 103 | In other words, if the data passing through Node.js to/from the application | |
@@ -181,6 +189,13 @@ the community they pose. | |||
| 181 | 189 | no scenario that requires modification of that configuration file is | |
| 182 | 190 | considered a vulnerability. | |
| 183 | 191 | ||
| 192 | + #### Uncontrolled Resource Consumption (CWE-400) on outbound connections | ||
| 193 | + | ||
| 194 | + * If Node.js is asked to connect to a remote site and return an | ||
| 195 | + artifact, it is not considered a vulnerability if the size of | ||
| 196 | + that artifact is large enough to impact performance and or | ||
| 197 | + cause the runtime to run out of resources. | ||
| 198 | + | ||
| 184 | 199 | ## Receiving security updates | |
| 185 | 200 | ||
| 186 | 201 | Security notifications will be distributed via the following methods. | |
0 commit comments