mirror of
https://github.com/nodejs/node.git
synced 2026-11-09 15:11:11 -05:00
Tobias Nießen
4aa0eff787
process.binding() can be used to trivially bypass restrictions imposed through a policy. Since the function is deprecated already, simply replace it with a stub when a policy is being enabled. Fixes: https://hackerone.com/bugs?report_id=1946470 PR-URL: https://github.com/nodejs-private/node-private/pull/397 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2023-32559
11 lines
129 B
JSON
11 lines
129 B
JSON
{
|
|
"resources": {
|
|
"./app.js": {
|
|
"integrity": true,
|
|
"dependencies": {
|
|
"assert": true
|
|
}
|
|
}
|
|
}
|
|
}
|