Tobias Nießen 242aaa0caa policy: disable process.binding() when enabled ...

process.binding() can be used to trivially bypass restrictions imposed
through a policy. Since the function is deprecated already, simply
replace it with a stub when a policy is being enabled.

Fixes: https://hackerone.com/bugs?report_id=1946470
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2023-32559
PR-URL: https://github.com/nodejs-private/node-private/pull/459

2023-08-08 09:59:12 -03:00

..

esm_loader.js

esm: fix erroneous re-initialization of ESMLoader

2022-07-31 15:27:46 +02:00

execution.js

lib: reset RegExp statics before running user code

2022-10-11 14:45:21 -05:00

per_thread.js

lib: refactor to avoid unsafe regex primordials

2022-08-02 09:59:01 +02:00

policy.js

policy: disable process.binding() when enabled

2023-08-08 09:59:12 -03:00

promises.js

lib: use null-prototype objects for property descriptors

2022-07-31 09:44:45 +02:00

report.js

process: use validateString validator

2022-03-14 09:32:00 -04:00

signal.js

process: refactor to use more primordials

2020-11-24 05:27:19 -08:00

task_queues.js

process: check for null instead of falsy in while loop

2022-03-14 09:32:03 -04:00

warning.js

lib: add comments to empty catch statements

2022-03-14 09:32:21 -04:00

worker_thread_only.js

bootstrap: use different scripts to setup different configurations

2019-12-20 22:10:13 +08:00