@@ -93,9 +93,9 @@ Vulnerabilities related to this case may be fixed by a documentation update.
93
93
2 . The operating system that Node.js is running under and its configuration,
94
94
along with anything under control of the operating system.
95
95
3 . The code it is asked to run including JavaScript and native code, even if
96
- said code is dynamically loaded, e.g. all dependencies installed from the npm registry.
97
- The code run inherits all the privileges of
98
- the execution user.
96
+ said code is dynamically loaded, e.g. all dependencies installed from the
97
+ npm registry.
98
+ The code run inherits all the privileges of the execution user.
99
99
4 . Inputs provided to it by the code it is asked to run, as it is the
100
100
responsibility of the application to perform the required input validations.
101
101
5 . Any connection used for inspector (debugger protocol) regardless of being
@@ -125,20 +125,20 @@ the community they pose.
125
125
in certficates used to connect to an https endpoint. If certificates can be
126
126
crafted which result in incorrect validation by the Node.js APIs that is
127
127
considered a vulnerability.
128
-
128
+
129
129
#### Inconsistent Interpretation of HTTP Requests (CWE-444)
130
-
130
+
131
131
* Node.js provides APIs to accept http connections. Those APIs parse the
132
132
headers received for a connection and pass them on to the application.
133
133
Bugs in parsing those headers which can result in request smuggling are
134
134
considered vulnerabilities.
135
-
135
+
136
136
#### Missing Cryptographic Step (CWE-325)
137
-
137
+
138
138
* Node.js provides APIs to encrypt data. Bugs that would allow an attacker
139
139
to get the orginal data without requiring the encryption key are
140
140
considered vulnerabilities.
141
-
141
+
142
142
#### External Control of System or Configuration Setting (CWE-15)
143
143
144
144
* If Node.js automatically loads a configuration file which is not documented
@@ -163,7 +163,7 @@ the community they pose.
163
163
* Node.js trusts the file system in the environment accessible to it.
164
164
Therefore, it is not a vulnerability if it accesses/loads files from any path
165
165
that is accessible to it.
166
-
166
+
167
167
#### External Control of System or Configuration Setting (CWE-15)
168
168
169
169
* If Node.js automatically loads a configuration file which is documented
0 commit comments