News for hackers. Stuff that matters.

A comment on 20% of all Node.js modules found vulnerable to injection attacks. Parent comment

Re:20% of all Node.js modules found vulnerable to injection ... by tonyarkles on Tuesday March 13, 2018 @08:35AM (#16575595)
Ahhhhh nice, I hadn't considered the "random temporary filename" or "db primary key" aspect either. That's something that gives me a small chill, but it's not the end of the world compared to "arbitrary user input piped to exec()"

Who knows how elaborate their static analyzer actually is in practice? I wrote a Python analyzer in grad school, and the results were both pretty interesting (type inference tracing through function calls) and pretty mediocre. It was also fiddly-as-hell to get working. Plus... the first rule of statically-analyzing dynamic languages is that the results get weird after the first eval()--anything could happen!

[ Parent | on HN ]
Re:20% of all Node.js modules found vulnerable to injection ... by acdha on Tuesday March 13, 2018 @09:14AM (#16575814)
Yeah, as a developer I see plenty of appeals to dynamic languages but they’re certainly a nightmare for tool authors. I know OpenStack was working on a security scanner for Python – I wonder what percentage of the open issues start with “this is probably very hard but…”
[ Parent | on HN ]