20% of all Node.js modules found vulnerable to injection attacks

Re:20% of all Node.js modules found vulnerable to injection ... by Ajedi32 on Monday March 12, 2018 @11:36AM (#16568829)

It's not even that. It's more like "20% of Node modules use _or include a module somewhere in their dependency chain which uses_ 'eval' or 'exec'".

So if my backup utility happens to depend on a wrapper library for node's Child Process module (which probably doesn't sanitize its inputs, as that would break quite a bit of functionality), it's considered "vulnerable".

[ Parent | on HN ]

Re:20% of all Node.js modules found vulnerable to injection ... by inetknght on Monday March 12, 2018 @11:40AM (#16568860)

And why shouldn't it be?

[ Parent | on HN ]

Re:20% of all Node.js modules found vulnerable to injection ... by Ajedi32 on Monday March 12, 2018 @11:43AM (#16568881)

Maybe because it's not sending user input into the "vulnerable" API? Or because it's not even calling the "vulnerable" API in the first place? Or because it's a system utility which will never be exposed to untrusted user input?

[ Parent | on HN ]