20% of all Node.js modules found vulnerable to injection attacks

Re:20% of all Node.js modules found vulnerable to injection ... by simonw on Monday March 12, 2018 @11:15AM (#16568666)

"Vulnerable to injection attacks" seems like a bit of a stretch to me.

Direct quote: "then about 20% of all modules turn out to directly or indirectly depend on at least one injection API"

Where "injection API" is a reference to either the eval() or exec() functions.

[ Parent | on HN ]

Re:20% of all Node.js modules found vulnerable to injection ... by shawabawa3 on Monday March 12, 2018 @11:18AM (#16568690)

To be fair they follow up with

> A staggering 90% of the call sites do not use any mitigation technique at all.

> Another 9% attempt to sanitise input using regular expressions. Unfortunately, most of those were not correctly implemented

[ Parent | on HN ]