4aa0eff787
process.binding() can be used to trivially bypass restrictions imposed through a policy. Since the function is deprecated already, simply replace it with a stub when a policy is being enabled. Fixes: https://hackerone.com/bugs?report_id=1946470 PR-URL: https://github.com/nodejs-private/node-private/pull/397 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2023-32559
10 lines
129 B
JSON
10 lines
129 B
JSON
{
|
|
"resources": {
|
|
"./app.js": {
|
|
"integrity": true,
|
|
"dependencies": {
|
|
"assert": true
|
|
}
|
|
}
|
|
}
|
|
}
|