4aa0eff787
process.binding() can be used to trivially bypass restrictions imposed through a policy. Since the function is deprecated already, simply replace it with a stub when a policy is being enabled. Fixes: https://hackerone.com/bugs?report_id=1946470 PR-URL: https://github.com/nodejs-private/node-private/pull/397 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2023-32559
10 lines
213 B
JavaScript
10 lines
213 B
JavaScript
'use strict';
|
|
|
|
const assert = require('assert');
|
|
|
|
assert.throws(() => { process.binding(); }, {
|
|
code: 'ERR_ACCESS_DENIED'
|
|
});
|
|
assert.throws(() => { process._linkedBinding(); }, {
|
|
code: 'ERR_ACCESS_DENIED'
|
|
});
|