 Tobias Nießen
|
4aa0eff787
|
policy: disable process.binding() when enabled
process.binding() can be used to trivially bypass restrictions imposed
through a policy. Since the function is deprecated already, simply
replace it with a stub when a policy is being enabled.
Fixes: https://hackerone.com/bugs?report_id=1946470
PR-URL: https://github.com/nodejs-private/node-private/pull/397
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2023-32559
|
2023-08-09 14:29:06 -03:00 |
|