2023-07-20のJS: vm2の開発終了、Storybook 7.1、Fresh 1.3
JSer.info #652 - Node.jsのnode:vmモジュールはSandbox(信用できないコードの実行環境)としては利用できませんが、vm2はnode:vmをラップしてSandboxを提供するモジュールでした。 今回、vm2の仕組み的に修正できないSandboxに関する脆弱性が発見されたため、メンテナンスを終了することが宣言されています。脆弱性の詳細はまだ公開されていませんが、Sandboxを破ることができる脆弱性で、PoCは8月ごろに公開される予定です。 Discontinued · Issue #533 · patriksimek/vm2 vm2 Sandbox Escape vulnerability · CVE-2023-37466 · GitHub Advisory Database Sandbox機能が欲しい場合は、QuickJSをWebAssemblyにコンパイ
Node.js — Tuesday June 20 2023 Security Releases
(Update 20-June-2023) Security releases available Updates are now available for all supported Node.js release lines for the following issues. OpenSSL Security updates This security release includes the following OpenSSL security updates OpenSSL security advisory 28th March. OpenSSL security advisory 20th April. OpenSSL security advisory 30th May. Impacts: All versions of the 20.x, 18.x, and 16.x r
Node.js Security starts with Node.js Secure Coding
Over the years, thousands of security vulnerabilities were discovered for Node.js packages, including next , axios , express , st , simple-git , ejs , moment and many others. It's time you learn from their mistakes, adopt secure coding practices and level up. Learn how to apply NodeJS Secure Coding techniques to prevent vulnerabilities in server-side JavaScript code such as Command Injection, Path
Node.js — Thursday February 16 2023 Security Releases
(Update 16-February-2023) Security releases available Updates are now available for the v19.x, v18.x, v16.x, and v14.x Node.js release lines for the following issues. OpenSSL Security updates This security release includes OpenSSL security updates as outlined in the recent OpenSSL security advisory. Impacts: All versions of the 19.x, 18.x, 16.x, and 14.x release lines. Node.js Permissions policies
Node.js にプロセスレベルの Permission が入りそうな話 - from scratch
Node.js の Permission についての解説を行います。 Node.js に Permission 機能が入りそう。 すでに PR が出されており、 land も間近です。おそらく次かその次くらいのリリースで入ることになるでしょう。 github.com おそらく初期リリースでは experimental flag を付けた上で、 fs, child_process, worker のパーミッションを許可するかどうかに留まり、 net, env などのパーミッションは今後になるでしょう。 以下の方法で利用します。 // filesystemの読み書きを許可する $ node --experimental-permission --allow-fs foo.mjs --allow-fs ファイルシステムの読み書きを行えるようにする --allow-fs-read= に記載のファイ
Node.js — Security Best Practices
Security Best Practices Intent This document intends to extend the current threat model and provide extensive guidelines on how to secure a Node.js application. Document Content Best practices: A simplified condensed way to see the best practices. We can use this issue or this guideline as the starting point. It is important to note that this document is specific to Node.js, if you are looking for
Safely sandbox and execute user submitted JavaScript?
I would like to have the ability to let users submit arbitrary JavaScript code, which is then sent to a Node.JS server and safely executed before the output is sent back to multiple clients (as JSON). The eval function comes to mind, but I know this has multiple security concerns (the user submitted code would be able to access Node's File API, etc). I have seen some projects like Microsoft Web Sa
Node.js — September 23rd 2022 Security Releases
(Update 26-September-2022) Security releases available Recommendation update regarding CVE-2022-35255: Roll-out and re-issue all keys generated with WebCrypto.subtle.generateKey(). Re-evaluate the confidentiality of data encrypted with those keys. (Update 23-September-2022) Security releases available Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following
Node.js — July 7th 2022 Security Releases
(Update 07-July-2022) Security releases available Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues. HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213) The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). More deta
Improve Security of node_modules and package.json Resolution · Issue #43192 · nodejs/node
What is the problem this feature will solve? It is easy to accidentally allow another user to influence what code node loads and executes. Details can be found at HackerOne reports 1564437 (CommonJS module loading), 1564444 (ECMAScript module resolution), and 1564445 (package.json). While these behaviors are documented, the security implications are easy to overlook. Insecure patterns around these
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Discontinued · Issue #533 · patriksimek/vm2
CVE-2023-26122 - GitHub Advisory Database
Sandbox Escape
THRIFT-3060: clear the offline queue when written by razvanz · Pull Request #1777 · apache/thrift
CVE-2023-28155 - GitHub Advisory Database
Node.js Security Progress Report – Permission Model Merged | OpenJS Foundation
Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js
我從 DiceCTF 2022 中學到的各種 JS 與前端冷知識
What are primordials in Node.js?
GitHub - yaakov123/hagana: NodeJS runtime protection for supply chain attacks
