GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — doc: clarify EventEmitter error handling in threat model · nodejs/node@33d0a8c

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

SECURITY.md

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎SECURITY.md‎`

Copy file name to clipboardExpand all lines: SECURITY.md

+12Lines changed: 12 additions & 0 deletions

Display the source diff
Display the rich diff

Original file line number	Diff line number	Diff line change
`@@ -335,6 +335,18 @@ the community they pose.`
`335`	`335`	`proper security boundaries between trusted application logic and untrusted`
`336`	`336`	`user input.`
`337`	`337`
	`338`	`+#### Unhandled 'error' Events on EventEmitters (CWE-248)`
	`339`	`+`
	`340`	+* EventEmitters that can emit `'error'` events require the application to
	`341`	+ attach an `'error'` event handler. This includes HTTP streams and other
	`342`	+ Node.js core streams. If the application fails to attach an `'error'`
	`343`	`+ handler, the EventEmitter will throw an uncaught exception, which may`
	`344`	`+ crash the process.`
	`345`	+* Crashes resulting from missing `'error'` handlers are not considered
	`346`	`+ denial-of-service vulnerabilities in Node.js. It is the application's`
	`347`	`+ responsibility to properly handle errors by attaching appropriate`
	`348`	+ `'error'` event listeners to EventEmitters that may emit errors.
	`349`	`+`
`338`	`350`	`## Assessing experimental features reports`
`339`	`351`
`340`	`352`	`Experimental features are eligible for security reports just like any other`

0 commit comments

Comments

0 (0)

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.