process.binding() can be used to trivially bypass restrictions imposed through a policy. Since the function is deprecated already, simply replace it with a stub when a policy is being enabled. Fixes: https://hackerone.com/bugs?report_id=1946470 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2023-32559 PR-URL: https://github.com/nodejs-private/node-private/pull/459 |
||
|---|---|---|
| .. | ||
| esm_loader.js | ||
| execution.js | ||
| per_thread.js | ||
| policy.js | ||
| promises.js | ||
| report.js | ||
| signal.js | ||
| task_queues.js | ||
| warning.js | ||
| worker_thread_only.js | ||