Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Npm security post-mortem

blog.npmjs.org

Post reply on HN
Print view View original

61–65 of 65 posts

Re: Npm security post-mortem

#61

Post by matt_kantor »

cyphunk wrote: post #53

> * Before they could start, we had a very serious security vulnerability responsibly disclosed by Will Farrington and Charlie Somerville > * We fixed it on February 17th the fix scares the shit out of me: https://github.com/isaacs/st/commit/5a0c1886737a20d78ae00b61... Properly escape all relevant html entities Avoid problems with files named things like ' ' and so on. - var name = f.replace(/"/g, '"') + var nam…

It looks like this change has more to do with XSS than the "big" exploit.

The more serious fix occurred here: https://github.com/isaacs/st/commit/6b54ce2d2fb912eadd31e2c2...

And here: https://github.com/isaacs/st/commit/6d6100eec8b19e2774a6f2bb...

With some icing on the cake here: https://github.com/isaacs/st/commit/8b2f212f64b762e351f311f4...

Re: Npm security post-mortem

#62

Post by Twirrim »

wycats wrote: post #7

It's worth noting that the XSS vulnerability ("A user could inject scripts into the npm website via the README and license fields") assuredly exposed a whole slew of easy-to-exploit vulnerabilities, and the community should feel very lucky that such an obvious vulnerability was in the wild for so long without being exploited. TL;DR always use a templating engine that makes you think about XSS and don't allow unsaniti…

> and the community should feel very lucky that such an obvious vulnerability was in the wild for so long without being exploited.

We have no reason to assume they haven't. The 0-day market is extremely lucrative, and they trade exploits rarely known to the wider community.

Re: Npm security post-mortem

#63

Post by roel_v »

Pacabel wrote: post #32
roel_v wrote: post #22

Earlier quoted context omitted.

"Why do they have to apologize for that?" It's just the sad state of the 'industry'. As soon as some armchair warrior finds something remotely wrong with whatever, they'll go nuts on you and you need this sort of touchy-feely PR nonsense to placate the comic book shop types. Hats off to these guys for being level-headed enough to be able to play the game this way - I couldn't do it any more, I'd go bonkers over overh…

If anyone needs placating, it's those developers, managers and executives who pushed hard for the use of Node.js in business settings, not expecting a serious security incident like this one to happen. For those who are especially serious about their careers, reputations, budgets and power, incidents like this involving the technologies they hyped and pushed through can be disastrous. Now they're seen as being very w…

PROTIP: if you're so serious about your 'career' and 'power', maybe you should stop 'hyping' and 'pushing through' this weeks hot tech toy you read about on HN and Reddit, and start building something worthwhile yourself. That way, you won't have to bet your precious career on some dude on the internet you never met before to not screw up. What a concept!

Re: Npm security post-mortem

#64

Post by cyphunk »

matt_kantor wrote: post #61
cyphunk wrote: post #53

> * Before they could start, we had a very serious security vulnerability responsibly disclosed by Will Farrington and Charlie Somerville > * We fixed it on February 17th the fix scares the shit out of me: https://github.com/isaacs/st/commit/5a0c1886737a20d78ae00b61... Properly escape all relevant html entities Avoid problems with files named things like ' ' and so on. - var name = f.replace(/"/g, '"') + var nam…

It looks like this change has more to do with XSS than the "big" exploit. The more serious fix occurred here: https://github.com/isaacs/st/commit/6b54ce2d2fb912eadd31e2c2... And here: https://github.com/isaacs/st/commit/6d6100eec8b19e2774a6f2bb... With some icing on the cake here: https://github.com/isaacs/st/commit/8b2f212f64b762e351f311f4...

not much more encouraging. it looks to me like patch work. ive had this in the past. would give a PoC to a client along with a recommended design change to the questionable methods of the code. they would send back a new version with a patch much like all of those linked here. in the end those patches address the PoC but not the problem. then i just rework the PoC to go around the patch. This cat-mouse game goes on until they go back, do the f'ing work, and implement the original design change suggested. I say all that just to point out that this looks like patch work and is a scary behaviour. Then again, maybe this is the nature of nodejs (omg).

Also, as a general rule:

    ANY SECURITY PATCH THAT IS A REGEX IS NOT A SECURITY PATCH

Re: Npm security post-mortem

#65

Post by hueving »

cyphunk wrote: post #64
matt_kantor wrote: post #61

Earlier quoted context omitted.

It looks like this change has more to do with XSS than the "big" exploit. The more serious fix occurred here: https://github.com/isaacs/st/commit/6b54ce2d2fb912eadd31e2c2... And here: https://github.com/isaacs/st/commit/6d6100eec8b19e2774a6f2bb... With some icing on the cake here: https://github.com/isaacs/st/commit/8b2f212f64b762e351f311f4...

not much more encouraging. it looks to me like patch work. ive had this in the past. would give a PoC to a client along with a recommended design change to the questionable methods of the code. they would send back a new version with a patch much like all of those linked here. in the end those patches address the PoC but not the problem. then i just rework the PoC to go around the patch. This cat-mouse game goes on u…

>ANY SECURITY PATCH THAT IS A REGEX IS NOT A SECURITY PATCH

Not true. Regex works well for forcing integers.

Post reply on HN