FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

meta: clarify the threat model to explain the JSON.parse case by mcollina · Pull Request #47276 · nodejs/node · GitHub

/ node Public

meta: clarify the threat model to explain the JSON.parse case - #47276

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
mcollina:security-model-updates
Mar 30, 2023
ConversationCommits (1)ChecksFiles changed
Merged

meta: clarify the threat model to explain the JSON.parse case#47276
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
mcollina:security-model-updates

Conversation

mcollina commented Mar 28, 2023

Copy link
Copy Markdown
Member

This PR clarifies our threat model to explain that JSON.parse(str) assumes that str is trusted.

mcollina requested review from RafaelGSS and mhdawson March 28, 2023 06:50
nodejs-github-bot added the doc Issues and PRs related to the documentations. label Mar 28, 2023
anonrig added author ready PRs that have at least one approval, no outstanding review comments, and a CI started. commit-queue Add this label to land a pull request using GitHub Actions. labels Mar 28, 2023
mhdawson approved these changes Mar 28, 2023
View reviewed changes

mhdawson left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM

cjihrig approved these changes Mar 28, 2023
View reviewed changes
Comment thread SECURITY.md Outdated
tniessen approved these changes Mar 28, 2023
View reviewed changes
Comment thread SECURITY.md Outdated
RafaelGSS approved these changes Mar 28, 2023
View reviewed changes

RafaelGSS left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM with above suggestions.

nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels Mar 30, 2023

nodejs-github-bot commented Mar 30, 2023

Copy link
Copy Markdown
Collaborator
Commit Queue failed
- Loading data for nodejs/node/pull/47276
✔  Done loading data for nodejs/node/pull/47276
----------------------------------- PR info ------------------------------------
Title      meta: clarify the threat model to explain the JSON.parse case (#47276)
Author     Matteo Collina  (@mcollina)
Branch     mcollina:security-model-updates -> nodejs:main
Labels     doc, author ready
Commits    3
 - meta: clarify the threat model to explain the JSON.parse case
 - Update SECURITY.md
 - Update SECURITY.md
Committers 2
 - Matteo Collina 
 - GitHub 
PR-URL: https://github.com/nodejs/node/pull/47276
Reviewed-By: Michaël Zasso 
Reviewed-By: Yagiz Nizipli 
Reviewed-By: Michael Dawson 
Reviewed-By: Colin Ihrig 
Reviewed-By: Tobias Nießen 
Reviewed-By: Rafael Gonzaga 
Reviewed-By: Luigi Pinca 
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/47276
Reviewed-By: Michaël Zasso 
Reviewed-By: Yagiz Nizipli 
Reviewed-By: Michael Dawson 
Reviewed-By: Colin Ihrig 
Reviewed-By: Tobias Nießen 
Reviewed-By: Rafael Gonzaga 
Reviewed-By: Luigi Pinca 
--------------------------------------------------------------------------------
   ⚠  Commits were pushed since the last review:
   ⚠  - Update SECURITY.md
   ⚠  - Update SECURITY.md
   ℹ  This PR was created on Tue, 28 Mar 2023 06:50:11 GMT
   ✔  Approvals: 7
   ✔  - Michaël Zasso (@targos) (TSC): https://github.com/nodejs/node/pull/47276#pullrequestreview-1360430964
   ✔  - Yagiz Nizipli (@anonrig): https://github.com/nodejs/node/pull/47276#pullrequestreview-1360903524
   ✔  - Michael Dawson (@mhdawson) (TSC): https://github.com/nodejs/node/pull/47276#pullrequestreview-1361060010
   ✔  - Colin Ihrig (@cjihrig) (TSC): https://github.com/nodejs/node/pull/47276#pullrequestreview-1361063434
   ✔  - Tobias Nießen (@tniessen) (TSC): https://github.com/nodejs/node/pull/47276#pullrequestreview-1361358121
   ✔  - Rafael Gonzaga (@RafaelGSS) (TSC): https://github.com/nodejs/node/pull/47276#pullrequestreview-1361672911
   ✔  - Luigi Pinca (@lpinca): https://github.com/nodejs/node/pull/47276#pullrequestreview-1361699799
   ✘  Last GitHub CI failed
   ℹ  Green GitHub CI is sufficient
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu
https://github.com/nodejs/node/actions/runs/4561490045

targos commented Mar 30, 2023

Copy link
Copy Markdown
Member 
SECURITY.md
Warning:   128:82  warning  Line must be at most 80 characters  maximum-line-length  remark-lint

meta: clarify the threat model to explain the JSON.parse case
b1dac8d 
Signed-off-by: Matteo Collina <hello@matteocollina.com>

mcollina commented Mar 30, 2023

Copy link
Copy Markdown
Member Author

Updated, PTAL

mcollina force-pushed the security-model-updates branch from 621585a to b1dac8d Compare March 30, 2023 07:07
mcollina added commit-queue Add this label to land a pull request using GitHub Actions. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. and removed commit-queue-failed An error occurred while landing this pull request using GitHub Actions. labels Mar 30, 2023
nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 30, 2023
nodejs-github-bot merged commit 42c4a35 into nodejs:main Mar 30, 2023

nodejs-github-bot commented Mar 30, 2023

Copy link
Copy Markdown
Collaborator

Landed in 42c4a35

RafaelGSS mentioned this pull request Apr 3, 2023
Merged
RafaelGSS pushed a commit that referenced this pull request Apr 5, 2023
meta: clarify the threat model to explain the JSON.parse case
0985548 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #47276
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
RafaelGSS mentioned this pull request Apr 6, 2023
Merged
RafaelGSS pushed a commit that referenced this pull request Apr 6, 2023
meta: clarify the threat model to explain the JSON.parse case
72e8bd3 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #47276
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
RafaelGSS pushed a commit that referenced this pull request Apr 7, 2023
meta: clarify the threat model to explain the JSON.parse case
2c95f6e 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #47276
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
danielleadams pushed a commit that referenced this pull request Jul 6, 2023
meta: clarify the threat model to explain the JSON.parse case
e859ca4 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #47276
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
danielleadams mentioned this pull request Jul 10, 2023
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

lpinca lpinca approved these changes
anonrig anonrig approved these changes
cjihrig cjihrig approved these changes
tniessen tniessen approved these changes
RafaelGSS RafaelGSS approved these changes
+2 more reviewers
targos targos approved these changes
mhdawson mhdawson approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

author ready PRs that have at least one approval, no outstanding review comments, and a CI started. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. doc Issues and PRs related to the documentations.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

Back | FazBrowse Home | New Git URL