doc: update threat model based on discussions - #46373
Conversation
Sorry, something went wrong.
Signed-off-by: Michael Dawson <mdawson@devrus.com>
|
@RafaelGSS, @mcollina, @jasnell how does this look to you? |
Sorry, something went wrong.
RafaelGSS
left a comment
There was a problem hiding this comment.
LGTM.
Sorry, something went wrong.
mcollina
left a comment
There was a problem hiding this comment.
lgtm
Sorry, something went wrong.
| * If Node.js is asked to connect to a remote site and return an | ||
| artifact, it is not considered a vulnerability if the size of | ||
| that artifact is large enough to impact performance and or | ||
| cause the runtime to run out of resources. |
There was a problem hiding this comment.
Is this actually true? Say I host a malicious server that triggers a hash table collision denial-of-service in node's http client - that's considered a vulnerability, right?
Sorry, something went wrong.
There was a problem hiding this comment.
@bnoordhuis I think your example is different in that it does not relate to the size of the artifact returned.
Sorry, something went wrong.
Signed-off-by: Michael Dawson <mdawson@devrus.com> PR-URL: #46373 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Signed-off-by: Michael Dawson <mdawson@devrus.com> PR-URL: #46373 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Signed-off-by: Michael Dawson <mdawson@devrus.com> PR-URL: #46373 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Signed-off-by: Michael Dawson mdawson@devrus.com