4aa0eff787
process.binding() can be used to trivially bypass restrictions imposed through a policy. Since the function is deprecated already, simply replace it with a stub when a policy is being enabled. Fixes: https://hackerone.com/bugs?report_id=1946470 PR-URL: https://github.com/nodejs-private/node-private/pull/397 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2023-32559
28 lines
606 B
JavaScript
28 lines
606 B
JavaScript
'use strict';
|
|
|
|
const common = require('../common');
|
|
common.requireNoPackageJSONAbove();
|
|
|
|
if (!common.hasCrypto)
|
|
common.skip('missing crypto');
|
|
|
|
const fixtures = require('../common/fixtures');
|
|
|
|
const assert = require('node:assert');
|
|
const { spawnSync } = require('node:child_process');
|
|
|
|
const dep = fixtures.path('policy', 'process-binding', 'app.js');
|
|
const depPolicy = fixtures.path(
|
|
'policy',
|
|
'process-binding',
|
|
'policy.json');
|
|
const { status } = spawnSync(
|
|
process.execPath,
|
|
[
|
|
'--experimental-policy', depPolicy, dep,
|
|
],
|
|
{
|
|
stdio: 'inherit'
|
|
},
|
|
);
|
|
assert.strictEqual(status, 0);
|