Commit fe674e9
doc: clarify defense-in-depth issues
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #64215
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>1 parent 54ca514 commit fe674e9
1 file changed
Lines changed: 8 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -276,6 +276,14 @@ the community they pose. | |||
| 276 | 276 | ||
| 277 | 277 | ### Examples of non-vulnerabilities | |
| 278 | 278 | ||
| 279 | + #### Defense-in-depth issues | ||
| 280 | + | ||
| 281 | + * Bugs whose fixes would only improve resilience after another security | ||
| 282 | + boundary has already failed, or reduce the impact of an issue outside the | ||
| 283 | + Node.js threat model, are considered defense-in-depth issues. | ||
| 284 | + * Defense-in-depth issues are never treated as Node.js security vulnerabilities, | ||
| 285 | + do not receive CVEs, and are handled as regular bugs or hardening improvements. | ||
| 286 | + | ||
| 279 | 287 | #### Malicious Third-Party Modules (CWE-1357) | |
| 280 | 288 | ||
| 281 | 289 | * Code is trusted by Node.js. Therefore any scenario that requires a malicious | |
0 commit comments