11–20 of 80 posts
Regular expressions are a very naive way of detecting calls to 'require'. For correctness you're better off recursively walking the AST. I've successfully used Detective in a couple of my personal projects to find all require statements. Relevant issue on Detective: https://github.com/substack/node-detective/issues/8
So I can make a malicious module called expres and another one called expresss and screw with ppls machines?
This. I love that the Node community enjoys innovating for convenience, but ideas like this one are less than half-baked from a security perspective. Just make a few typo'd popular packages, and use npm install scripts [1] and you have a very easy remote code execution vector on developer workstations. The bigger problem I see is that npm is a circus. No package signing and a ridiculous debate on why that's been goin…
This is otherwise known as an active developer community and is a good thing. In any open library ecosystem, it's ultimately up to the developer to carefully choose and vet third-party modules. There isn't any substitute for that.
The alternative is a tightly controlled standard library, but that isn't npm's stated goal. Such a controlled, curated, audited standard library is, however, something that could be built on top of npm, but obviously not vice versa.
So npm being a circus is, in the grander scheme of things, a good thing. Novice programmers will necessarily produce novice code.
edit: if it wasn't clear, I completely agree about the security risks of this project.
Regular expressions are a very naive way of detecting calls to 'require'. For correctness you're better off recursively walking the AST. I've successfully used Detective in a couple of my personal projects to find all require statements. Relevant issue on Detective: https://github.com/substack/node-detective/issues/8
The AST? What AST is that? You don't get access to an AST.
So I can make a malicious module called expres and another one called expresss and screw with ppls machines?
Regular expressions are a very naive way of detecting calls to 'require'. For correctness you're better off recursively walking the AST. I've successfully used Detective in a couple of my personal projects to find all require statements. Relevant issue on Detective: https://github.com/substack/node-detective/issues/8
The AST? What AST is that? You don't get access to an AST.
I am very interested in this for projects that I'm just starting and don't expect to run on anything but my machine. It's an annoying break of flow to be writing code and say "Crap, I need request or lodash" and have to stop, npm install --save, require, then go back to what I'm doing. Yes I still have to require it in but for side projects/one-offs I find this pretty cool.
Given that in npm v3 the order of installation determines where things are installed, this seems like it might cause some interesting bugs that never happen on the developer's machine. :)
So I can make a malicious module called expres and another one called expresss and screw with ppls machines?
Earlier quoted context omitted.
This. I love that the Node community enjoys innovating for convenience, but ideas like this one are less than half-baked from a security perspective. Just make a few typo'd popular packages, and use npm install scripts [1] and you have a very easy remote code execution vector on developer workstations. The bigger problem I see is that npm is a circus. No package signing and a ridiculous debate on why that's been goin…
> It's not usually core, it's all the plugins by authors of unknown provenance and skill. This is otherwise known as an active developer community and is a good thing. In any open library ecosystem, it's ultimately up to the developer to carefully choose and vet third-party modules. There isn't any substitute for that. The alternative is a tightly controlled standard library, but that isn't npm's stated goal. Such a…
But, "Novice programmers will necessarily produce novice code."
Having had my own variety of experience with CPAN, PEAR, Tcl's package thing, C by way of building my own RPMs and DEBs, and now watching the ongoing trainwreck that is npm, yes. You're right about that.