Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

zeroserver.io

Post reply on HN
Print view View original

91–100 of 256 posts

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#91

Post by SahAssar »

adrusi wrote: post #52
q3k wrote: post #31

Earlier quoted context omitted.

Because if you ever have a broken upload system that allows you to drop a JS file somewhere accessible by the file system routing, you have remote code execution. Additionally, you now have to write guards in every non-endpoint JS file so that it doesn't get executed just by a misplaced HTTP request. And as for automatic dependency resolution, this means you're not even aware of what transitive dependencies you're pu…

Make your application directory read-only to the user running the application, as it ought to be anyway. Automatic dependency resolution however... Fantastic for experimentation, but that's a dealbreaker for production. Maybe it would be OK if it actually wrote the package-lock.json to the application directory, I'd have to think about that.

In this case the application also tries to auto-install dependencies, so making it read-only removes one of the stated features.

I think this framework hasn't been written with security in mind at all.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#92

Post by q3k »

asadlionpk wrote: post #82
q3k wrote: post #75

Earlier quoted context omitted.

Putting my money where my mouth is - use this to leak any file accessible by the running user of zero from the filesystem: # curl -v --path-as-is 127.0.0.1:3000/../../../../../etc/passwd root:x:0:0:root:/root:/bin/bash [...]

Thanks for pointing this out. Fixed this particular bug!

You also need to report this to security@npmjs.com so they post an advisory [1] and mark the existing versions as vulnerable.

[1] - https://www.npmjs.com/advisories

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#94

Post by curioussavage »

asadlionpk wrote: post #45
aboutruby wrote: post #34

Earlier quoted context omitted.

Probably having .htaccess / .env / database configuration / files that are not supposed to be public be exposed. For instance, Rails has a public/ folder for files that are going to be served. And jekyll hides files by pattern-matching them[1]. Zero doesn't seem to have exclude folders by default. The solution would be to run Zero is a subfoler and require file in the parent folder which would act as the tree's root.…

Currently, files starting with _ (underscore) are hidden in zero. This is still a feature spec we need to finalize as this can create confusion. Maybe a .zeroignore file (as suggested in another comment) would be a better idea.

Why not reverse that and use a whitelist instead. It’s a lot easier to decide what folders and files should be served than to think of all the things that shouldn’t.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#96

Post by Sephr »

q3k wrote: post #92
asadlionpk wrote: post #82

Earlier quoted context omitted.

Thanks for pointing this out. Fixed this particular bug!

You also need to report this to security@npmjs.com so they post an advisory [1] and mark the existing versions as vulnerable. [1] - https://www.npmjs.com/advisories

Anyone, including yourself can do that.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#97

Post by Cu3PO42 »

jecxjo wrote: post #87
Cu3PO42 wrote: post #68

Earlier quoted context omitted.

I don't disagree that this doesn't seem necessarily secure and the auto dependency resolution is a bad idea for other reasons in my opinion, but I don't see the security aspect of it. The moment I can upload files to the application folder that are executed, I can just `require('child_process').spawn("my_evil_stuff", [])`. In particular "my_evil_stuff" could be some npm install command. I don't see how automatically…

Where is the management of requirements? How do you force LTS versions? Or roll back if a version has a vulnerability? When things are automatic you are unable to stop bad things from happening.

Not that I was going to say this is a good idea in the first place, but rolling back vulnerable dependencies is an excellent point that I hadn't thought of. Thanks!

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#98

Post by dfxm12 »

beefhash wrote: post #57
jayar95 wrote: post #44

Earlier quoted context omitted.

If security is a concern, this is probably a bad choice; this doesn't seem to be advertised as a bulletproof security solution to anything, rather a utility for small little one-off apps that might need _some_ backend functionality. Once you start adding features like file-uploading, youre obviously gonna want to pick a more robust option

> If security is a concern At the risk of being presumptuous... When is security ever not a concern?

Prototyping or proofs of concept

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#99

Post by squirrelicus »

wesleytodd wrote: post #81
reidjs wrote: post #58

Earlier quoted context omitted.

Student projects

Pretty sure student projects should teach you something other than `$ npm install`, no? When I was a hiring manager and scoped out juniors from bootcamps I had a conversation with some candidates and they would say, "I built user registration and login". When I asked them to talk more about it they said, "well I installed auth0"... Any student project which doesn't teach them how something works is not really teachin…

Expecting a student to learn how to code at all, not to mention code well, from an academic/bootcamp setting, is an expensive fool's errand for anyone that hires them.

Programming is not academic. It has more in common with plumbing and carpentry and electrician work: you learn only by doing, and you learn how to do it well by doing with critical supervision from a mentor.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#100

Post by SahAssar »

wesleytodd wrote: post #78
progx wrote: post #74

Earlier quoted context omitted.

Welcome to the world of node.

This is nothing to do with node. This is poor programmer decision making. You can build great node apps with a real minimalist approach. Holding up projects which pull in half of npm as "the world of node" is like holding up a hot and ready 5$ pizza and saying all Italian food is bad.

I think the point is that this is almost encouraged in the node ecosystem, while in most other language ecosystems I know of it wouldn't be.
Post reply on HN