GeezerVison

Nit: "examples" (plural) but there appears to be only one example provided

Nit: Consider changing worth reporting here and below to something else? If it's a bug, it's worth reporting. It's just a question of whether it's a security issue or whether the bug is in Node.js itself or end-user code.

Maybe change this entire sentence to:

It can be difficult to determine if an issue is a valid security issue or not.

Then change any attack worth reporting via the security address in the next sentence to a valid security issue?

clarified

Nit: and -> or?

I think its accurate as is. Its a security issue if it affect the app OR the system the app is on (either one). Its not necessary that it effect the app AND the system.

@sam-github I think you misread me. I'm talking about changing and to or, not the other way around. Right now, it says it's a valid security issue if it affects "the confidentiality, integrity, and availability of the Node.js application...". I think it should say `or availability of the Node.js application...". Like, if you can affect availability, that's a security issue even if it doesn't also affect confidentiality.

I did misreadh, changed.

I think it may be worth defining "attacker" here. What abilities does the attacker have? (e.g., do they interface with the system over HTTP, fs, etc.?)

Can you suggest some wording? Couldn't an attacker could have any capability, where the important thing is they are attempting to do something they are not intended to be able to do? That is, that they are attempting to escalate privilege? Of course, as the capability of executing arbitrary js code is already the highest privelege, escalation from there is not possible.

Ah, yes, that makes sense. I think what threw me off is the whole no-escalating-above-arbitrary-js-code is explained in the example. I think it might help clarify to pull it up to this paragraph.

Given that the definition is fairly abstract, it would also be helpful to have a few examples of attackers, along with escalations that would be considered security vulnerabilities. I imagine that we're often thinking of attackers as HTTP clients that try to escalate above being able to send HTTP messages to the system. It's clear that being able to remotely execute code from an HTTP request is an escalation that would be considered a security vulnerability, but are there examples of more subtle escalations that would count?

Showing examples of particular issues that were in fact considered security issues would also help. Do we have examples we can use? I think nodejs/security-wg#17 will help us get good examples: having a private disclosure process that retroactively turns public once the issue is resolved will make the boundaries more clear.

I'd agree more examples, including some positive examples would be useful.

s/There is not any hard and fast rule/There are no hard and fast rules

I'd strike via the security address

s/affect/compromise

The "for which the attacker does not already have the capability" is a bit odd. Perhaps just strike that part?

If you have the right to run arbitrary js code, calling process.exit() isn't a vuln. If you have the mysql credentials, being able to dump the DB isn't a vuln. If you need shell access to execute an exploit that gives you shell access, its not a vuln. I think this is important, a vulnerability allows capability escalation, if you already have the capability, it isn't a vuln.