gitroo-admin/node
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
node/lib/internal/policy
History
Exact
Tobias Nießen 1c538938cc
 policy: use tamper-proof integrity check function 
Using the JavaScript Hash class is unsafe because its internals can be
tampered with. In particular, an application can cause
Hash.prototype.digest() to return arbitrary values, thus allowing to
circumvent the integrity verification that policies are supposed to
guarantee.

Add and use a new C++ binding internalVerifyIntegrity() that (hopefully)
cannot be tampered with from JavaScript.

PR-URL: https://github.com/nodejs-private/node-private/pull/462
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/493
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2023-38552
2023-10-13 07:33:49 -04:00
..
manifest.js policy: use tamper-proof integrity check function 2023-10-13 07:33:49 -04:00
sri.js lib: enforce use of trailing commas in more files 2023-04-03 07:43:56 -04:00