61–70 of 256 posts
Earlier quoted context omitted.
> If security is a concern At the risk of being presumptuous... When is security ever not a concern?
Student projects
Minimalism has a cost. http://npm.broofa.com/?q=zero
Standing on the shoulders of giants :) You will eventually be adding all those packages when you develop a production-grade React / Node app anyway.
> File-system Based Routing: If your code resides in ./api/login.js it's exposed at /api/login" rel="nofollow">http:// /api/login . Inspired by good ol' PHP days. > Auto Dependency Resolution: If a file does require('underscore'), it is automatically installed and resolved. You can always create your own package.json file to install a specific version of a package. This sounds like a security nightmare. EDIT: to be c…
By this time it's already too late.
> File-system Based Routing: If your code resides in ./api/login.js it's exposed at /api/login" rel="nofollow">http:// /api/login . Inspired by good ol' PHP days. > Auto Dependency Resolution: If a file does require('underscore'), it is automatically installed and resolved. You can always create your own package.json file to install a specific version of a package. This sounds like a security nightmare. EDIT: to be c…
So if an attacker already has access to your filesystem to modify your files, they can install stuff? By this time it's already too late.
Some classes of bugs that would be otherwise tame due to the constraints (eg., file upload that might be able to only create new files in some part of the directory tree, or a buggy routine that lets you create arbitrary symlinks, or leftover VCS/CM files that happen to end in .js and are not filtered out by the router) now become the most powerful kind, remote code execution.
Earlier quoted context omitted.
If security is a concern, this is probably a bad choice; this doesn't seem to be advertised as a bulletproof security solution to anything, rather a utility for small little one-off apps that might need _some_ backend functionality. Once you start adding features like file-uploading, youre obviously gonna want to pick a more robust option
> If security is a concern At the risk of being presumptuous... When is security ever not a concern?
Internal applications where the entirety of the userbase are trusted employees. (Preferably, the userbase is small, too.)
Nobody’s going to bother finding vulnerabilities in an application where, if they break it, their own job gets harder.
In this example, it is the complexity of this file[1] and the fact that if you were to write this as a single express middleware you could probably write it in less than 20 lines.
Guess this is just not my cup of tea?
[1] https://github.com/remoteinterview/zero/blob/master/packages...
Edit: also looks like the author decided to wrap their own multi process model? https://github.com/remoteinterview/zero/blob/master/packages...
Maybe a silly question, but is there anything one needs to consider before deploying this to, let's say, Heroku?
> File-system Based Routing: If your code resides in ./api/login.js it's exposed at /api/login" rel="nofollow">http:// /api/login . Inspired by good ol' PHP days. > Auto Dependency Resolution: If a file does require('underscore'), it is automatically installed and resolved. You can always create your own package.json file to install a specific version of a package. This sounds like a security nightmare. EDIT: to be c…
The moment I can upload files to the application folder that are executed, I can just `require('child_process').spawn("my_evil_stuff", [])`. In particular "my_evil_stuff" could be some npm install command. I don't see how automatically installing the dependencies makes this worse than it already is.
EDIT: While this is a different attack vector than I was envisioning here, jexco has provided a scenario in which there are additional vulnerabilities: Vulnerable dependencies that cannot be managed.
Maybe a silly question, but is there anything one needs to consider before deploying this to, let's say, Heroku?
Earlier quoted context omitted.
> If security is a concern At the risk of being presumptuous... When is security ever not a concern?
> When is security ever not a concern? Internal applications where the entirety of the userbase are trusted employees. (Preferably, the userbase is small, too.) Nobody’s going to bother finding vulnerabilities in an application where, if they break it, their own job gets harder.
Your sort of thinking is how you end up with Yahoo levels of account leaks.
Security always matters.