e673c03629
Using the JavaScript Hash class is unsafe because its internals can be tampered with. In particular, an application can cause Hash.prototype.digest() to return arbitrary values, thus allowing to circumvent the integrity verification that policies are supposed to guarantee. Add and use a new C++ binding internalVerifyIntegrity() that (hopefully) cannot be tampered with from JavaScript. PR-URL: https://github.com/nodejs-private/node-private/pull/462 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2023-38552 |
||
|---|---|---|
| .. | ||
| crypto-default-encoding | ||
| crypto-hash-tampering | ||
| dependencies | ||
| process-binding | ||
| bad-main.mjs | ||
| canonicalize.mjs | ||
| dep-policy.json | ||
| dep.js | ||
| main.mjs | ||
| multi-deps.js | ||
| parent.js | ||