20% of all Node.js modules found vulnerable to injection attacks
blog.acolyer.org
20% of all Node.js modules found vulnerable to injection attacks
1–10 of 42 posts
Re: 20% of all Node.js modules found vulnerable to injection attacks
#2"Vulnerable to injection attacks" seems like a bit of a stretch to me.
Direct quote: "then about 20% of all modules turn out to directly or indirectly depend on at least one injection API"
Where "injection API" is a reference to either the eval() or exec() functions.
Re: 20% of all Node.js modules found vulnerable to injection attacks
#3This headline is entirely false - 20% of Node modules use 'eval' or 'exec'. While these are certainly less secure and a strong secure coding standard would probably ban them or at least reduce their use, it's entirely possible to use both in safe ways.
Re: 20% of all Node.js modules found vulnerable to injection attacks
#4This headline is entirely false - 20% of Node modules use 'eval' or 'exec'. While these are certainly less secure and a strong secure coding standard would probably ban them or at least reduce their use, it's entirely possible to use both in safe ways.
Further on:
> 18,924 of all 51,627 call sites are found to be statically safe (36.66%)
> The templates for the vast majority of call sites have at most one hole, and very few templates contain more than five.
If you've got a dependency that calls eval or exec, those aren't great odds that they're doing it safely.
Re: 20% of all Node.js modules found vulnerable to injection attacks
#5"Vulnerable" due to eval() or exec()? Not really an "injection API".
Re: 20% of all Node.js modules found vulnerable to injection attacks
#6"Vulnerable to injection attacks" seems like a bit of a stretch to me. Direct quote: "then about 20% of all modules turn out to directly or indirectly depend on at least one injection API" Where "injection API" is a reference to either the eval() or exec() functions.
To be fair they follow up with
> A staggering 90% of the call sites do not use any mitigation technique at all.
> Another 9% attempt to sanitise input using regular expressions. Unfortunately, most of those were not correctly implemented
Re: 20% of all Node.js modules found vulnerable to injection attacks
#7tl;dr people pushing security tools for nodejs say security tools are the new most important aspect of node servers because some of them use calls that could maybe possibly be used in an unsafe manner but currently don't appear to be.
Re: 20% of all Node.js modules found vulnerable to injection attacks
#8This headline is entirely false - 20% of Node modules use 'eval' or 'exec'. While these are certainly less secure and a strong secure coding standard would probably ban them or at least reduce their use, it's entirely possible to use both in safe ways.
Possible, but unlikely. eval is particularly difficult to use correctly, and can almost always be replaced with something better.
Re: 20% of all Node.js modules found vulnerable to injection attacks
#9That's click-bait
Re: 20% of all Node.js modules found vulnerable to injection attacks
#10[deleted]