@@ -335,6 +335,21 @@ the community they pose. |
335 | 335 | proper security boundaries between trusted application logic and untrusted |
336 | 336 | user input. |
337 | 337 |
|
| 338 | +#### Build System Attacks Requiring Control of the Build Environment (CWE-78, CWE-114, CWE-276) |
| 339 | + |
| 340 | +* The Node.js build system (e.g., `configure`, `configure.py`, `Makefile`, |
| 341 | + `vcbuild.bat`) is designed to run in a trusted build environment. |
| 342 | + The build environment, including environment variables, the file system, |
| 343 | + and locally installed tools, is a trusted element in the Node.js threat model. |
| 344 | +* Reports about command injection via environment variables in build scripts |
| 345 | + (e.g., `CC`, `CXX`, `PKG_CONFIG`, `RUSTC`), path hijacking in build output |
| 346 | + directories, or file permissions of build artifacts are **not** considered |
| 347 | + vulnerabilities. These scenarios require the attacker to already have control |
| 348 | + over the build environment, which means the system is already compromised. |
| 349 | +* Build scripts are not a security boundary. They are expected to execute |
| 350 | + tools and scripts specified by the environment, and to trust the |
| 351 | + file system they operate on. |
| 352 | + |
338 | 353 | #### Unhandled 'error' Events on EventEmitters (CWE-248) |
339 | 354 |
|
340 | 355 | * EventEmitters that can emit `'error'` events require the application to |
|