Re:20% of all Node.js modules found vulnerable to injection ...
by acdha on Monday March 12, 2018 @04:32PM
(#16571310)
True — it wasn't clear to me whether e.g. a random temporary filename would be considered static or only actual fixed strings in the code. (Similar questions would arise if e.g. a web app saved things using a database primary key so it's technically not static but the attacker doesn't control it even if they control the file contents)
[ Parent
| on HN ]
Re:20% of all Node.js modules found vulnerable to injection ...
by tonyarkles on Tuesday March 13, 2018 @08:35AM
(#16575595)
Ahhhhh nice, I hadn't considered the "random temporary filename" or "db primary key" aspect either. That's something that gives me a small chill, but it's not the end of the world compared to "arbitrary user input piped to exec()"
Who knows how elaborate their static analyzer actually is in practice? I wrote a Python analyzer in grad school, and the results were both pretty interesting (type inference tracing through function calls) and pretty mediocre. It was also fiddly-as-hell to get working. Plus... the first rule of statically-analyzing dynamic languages is that the results get weird after the first eval()--anything could happen!
Re:20% of all Node.js modules found vulnerable to injection ...
by acdha on Tuesday March 13, 2018 @09:14AM
(#16575814)
Yeah, as a developer I see plenty of appeals to dynamic languages but they’re certainly a nightmare for tool authors. I know OpenStack was working on a security scanner for Python – I wonder what percentage of the open issues start with “this is probably very hard but…”