Netmask NPM package, used by 270k+ projects, vulnerable to octal input data

Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by JimDabell on Monday March 29, 2021 @10:40AM (#26622374)

> I can trust code that is part of Java, .Net or Python standard library is good or decent quality.

I think you’re being a little optimistic there.

Consider Java’s URL class, for instance. Its equals() implementation will resolve the hostname in both URLs and consider them equal if they resolve to the same IP address. So that’s a) completely wrong, b) a potential source of security problems (consider an attacker pointing their hostname to your IP address to control URLs that are “equal” to your URLs, for instance), c) horribly unpredictable (two URLs may or may not be the same depending on whether you are online or not), and d) awful for performance (introduces a network lookup even for hashcode(), for instance).

That’s significantly worse than a bug like this, which is essentially an oversight that failed to consider an obscure notation nobody uses.

> Say you grab a 10 years old Java/.Net project source and a node one, and try to setup a developer environment to be able to create a fix. Would you bet that on average is 10X harder to get stuff to run on node ?

Java is probably okay, but I’ve tried this with .NET and it was extremely painful.

[ Parent | on HN ]

Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by simion314 on Monday March 29, 2021 @11:03AM (#26622773)

Funny enough you mention url, I had to fix a bug recently in JS code where our project was rejecting valid urls, the issue was that someone found somewhere a regex that validated urls but during the years the standards updated and now more characters were allowed. So copy pasting perfectly good code is bad because it might get outdated.

I would bet that on average Java standard library code(that is not deprecated) will be higher quality then npm packages.

[ Parent | on HN ]