GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — doc: add Node.js Threat Model by RafaelGSS · Pull Request #45223 · nodejs/node

Conversation

@RafaelGSS

@RafaelGSS RafaelGSS commented Oct 28, 2022

Copy link
Copy Markdown
Member

Reference: nodejs/security-wg#799
Following up: nodejs/nodejs.org#4896

This is another Security WG initiative. We've been actively working on that and finally, we have something to share.

This document was created aiming to provide context on what will/will not be considered a vulnerability in Node.js, targeting Security Researchers, as well as serve as a guide for application security operations in support of development teams building on top of the Node.js platform.

cc: @nodejs/security @nodejs/security-wg @nodejs/tsc

Co-authored-by: Michael Dawson [email protected]
Co-authored-by: Facundo Tuesca [email protected]
Co-authored-by: Ulises Gascon [email protected]
Co-authored-by: Thomas Gentilhomme [email protected]

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
bricss and iamvolvo reacted with eyes emoji
All reactions
  • 👀 2 reactions
@nodejs-github-bot nodejs-github-bot added the doc Issues and PRs related to Node.js documentation. label Oct 28, 2022
RafaelGSS
RafaelGSS commented Oct 28, 2022
View reviewed changes
Comment thread SECURITY.md Outdated

@RafaelGSS RafaelGSS Oct 28, 2022

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're assessing if that's a blocker for this PR or it can land without a documentation update for now.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@mhdawson mhdawson Oct 28, 2022

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My current take is that we are documenting/agreeing on what we should do with vulnerabilty reports. As soon as we agree I'm thinking we should take reports, I don't think we load all that many files and if we don't have them documented and people want to help identify them for us, that's not necessarily bad.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@RafaelGSS
RafaelGSS force-pushed the add-threat-model branch from fc174c7 to 11b5dfb Compare October 28, 2022 14:14
Trott
Trott reviewed Oct 28, 2022
View reviewed changes
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
Trott
Trott reviewed Oct 28, 2022
View reviewed changes
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
@Trott

This comment was marked as resolved.

Sign in to view
@Trott

This comment was marked as resolved.

Sign in to view
Trott
Trott reviewed Oct 28, 2022
View reviewed changes
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
VoltrexKeyva
VoltrexKeyva reviewed Oct 28, 2022
View reviewed changes
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
mhdawson
mhdawson reviewed Oct 28, 2022
View reviewed changes
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
@RafaelGSS
RafaelGSS force-pushed the add-threat-model branch from 11b5dfb to 2626cbd Compare October 31, 2022 15:44
@mhdawson mhdawson added the tsc-agenda Issues and PRs to discuss during Technical Steering Committee meetings. label Oct 31, 2022
@mhdawson

mhdawson commented Oct 31, 2022

Copy link
Copy Markdown
Member

Putting on TSC agenda for awareness.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mhdawson mhdawson mentioned this pull request Oct 31, 2022
Node.js Technical Steering Committee (TSC) Meeting 2022-11-02 nodejs/TSC#1302
Closed
mcollina
mcollina requested changes Nov 2, 2022
View reviewed changes

@mcollina mcollina left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please list some good examples of vulnerabilities?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
@mhdawson

mhdawson commented Nov 3, 2022

Copy link
Copy Markdown
Member

@RafaelGSS sorry I meant to add the examples as a set of suggested changes but ended up pushing directly.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mhdawson

mhdawson commented Nov 3, 2022

Copy link
Copy Markdown
Member

@mcollina added examples as requested.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
mhdawson
mhdawson reviewed Nov 3, 2022
View reviewed changes
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
mhdawson
mhdawson reviewed Nov 3, 2022
View reviewed changes
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
gireeshpunathil
gireeshpunathil reviewed Nov 4, 2022
View reviewed changes
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
Trott
Trott reviewed Nov 5, 2022
View reviewed changes
Comment thread SECURITY.md Resolved

Uh oh!

There was an error while loading. Please reload this page.
This was referenced Nov 7, 2022
Node.js Technical Steering Committee (TSC) Meeting 2022-11-09 nodejs/TSC#1304
Closed
Give access to @UlisesGascon to Mac OS test machines nodejs/build#3068
Closed
@RafaelGSS
RafaelGSS force-pushed the add-threat-model branch 2 times, most recently from 5ba7ef6 to 0216617 Compare November 9, 2022 19:43
@RafaelGSS
RafaelGSS requested review from Trott, VoltrexKeyva, gireeshpunathil, mcollina and mhdawson November 9, 2022 19:43
@RafaelGSS @mhdawson
@facutuesca @UlisesGascon @fraxken
doc: add Node.js Threat Model
8e7ea63 
Co-authored-by: Michael Dawson <[email protected]>
Co-authored-by: Facundo Tuesca <[email protected]>
Co-authored-by: Ulises Gascon <[email protected]>
Co-authored-by: Thomas Gentilhomme <[email protected]>
@RafaelGSS
RafaelGSS force-pushed the add-threat-model branch from 2da87c8 to 8e7ea63 Compare November 16, 2022 15:48
Trott
Trott approved these changes Nov 16, 2022
View reviewed changes
@BethGriggs BethGriggs mentioned this pull request Nov 16, 2022
Nominating RafaelGSS to the TSC nodejs/TSC#1308
Closed
@RafaelGSS RafaelGSS added the commit-queue PRs queued for automated landing through the Commit Queue. label Nov 21, 2022
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Nov 21, 2022
@nodejs-github-bot
nodejs-github-bot merged commit 487fa8a into nodejs:main Nov 21, 2022
@nodejs-github-bot

nodejs-github-bot commented Nov 21, 2022

Copy link
Copy Markdown
Collaborator

Landed in 487fa8a
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
tniessen added a commit to tniessen/node that referenced this pull request Nov 21, 2022
@tniessen
doc: fix typo in threat model
3900ae7 
Refs: nodejs#45223
@tniessen tniessen mentioned this pull request Nov 21, 2022
doc: fix typo in threat model #45558
Merged
nodejs-github-bot pushed a commit that referenced this pull request Nov 21, 2022
@tniessen
doc: fix typo in threat model
ccd3a42 
Refs: #45223
PR-URL: #45558
Reviewed-By: Harshitha K P <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
ruyadorno pushed a commit that referenced this pull request Nov 21, 2022
@RafaelGSS @mhdawson
@facutuesca @UlisesGascon @fraxken @ruyadorno
doc: add Node.js Threat Model
5b1df22 
Co-authored-by: Michael Dawson <[email protected]>
Co-authored-by: Facundo Tuesca <[email protected]>
Co-authored-by: Ulises Gascon <[email protected]>
Co-authored-by: Thomas Gentilhomme <[email protected]>
PR-URL: #45223
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
ruyadorno pushed a commit that referenced this pull request Nov 21, 2022
@tniessen @ruyadorno
doc: fix typo in threat model
246cd35 
Refs: #45223
PR-URL: #45558
Reviewed-By: Harshitha K P <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
@ruyadorno ruyadorno mentioned this pull request Nov 24, 2022
v19.2.0 proposal #45615
Merged
@danielleadams danielleadams mentioned this pull request Dec 30, 2022
v18.13.0 release proposal #46025
Merged
danielleadams pushed a commit that referenced this pull request Dec 30, 2022
@RafaelGSS @mhdawson
@facutuesca @UlisesGascon @fraxken @danielleadams
doc: add Node.js Threat Model
6128cf1 
Co-authored-by: Michael Dawson <[email protected]>
Co-authored-by: Facundo Tuesca <[email protected]>
Co-authored-by: Ulises Gascon <[email protected]>
Co-authored-by: Thomas Gentilhomme <[email protected]>
PR-URL: #45223
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
danielleadams pushed a commit that referenced this pull request Dec 30, 2022
@tniessen @danielleadams
doc: fix typo in threat model
c2c7b8d 
Refs: #45223
PR-URL: #45558
Reviewed-By: Harshitha K P <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
danielleadams pushed a commit that referenced this pull request Jan 3, 2023
@RafaelGSS @mhdawson
@facutuesca @UlisesGascon @fraxken @danielleadams
doc: add Node.js Threat Model
e851c43 
Co-authored-by: Michael Dawson <[email protected]>
Co-authored-by: Facundo Tuesca <[email protected]>
Co-authored-by: Ulises Gascon <[email protected]>
Co-authored-by: Thomas Gentilhomme <[email protected]>
PR-URL: #45223
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
danielleadams pushed a commit that referenced this pull request Jan 3, 2023
@tniessen @danielleadams
doc: fix typo in threat model
31233b2 
Refs: #45223
PR-URL: #45558
Reviewed-By: Harshitha K P <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
danielleadams pushed a commit that referenced this pull request Jan 5, 2023
@RafaelGSS @mhdawson
@facutuesca @UlisesGascon @fraxken @danielleadams
doc: add Node.js Threat Model
33a2419 
Co-authored-by: Michael Dawson <[email protected]>
Co-authored-by: Facundo Tuesca <[email protected]>
Co-authored-by: Ulises Gascon <[email protected]>
Co-authored-by: Thomas Gentilhomme <[email protected]>
PR-URL: #45223
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
danielleadams pushed a commit that referenced this pull request Jan 5, 2023
@tniessen @danielleadams
doc: fix typo in threat model
f743fe6 
Refs: #45223
PR-URL: #45558
Reviewed-By: Harshitha K P <[email protected]>
Reviewed-By: Darshan Sen <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
@wesleytodd wesleytodd mentioned this pull request Mar 2, 2024
Formation of a Security Working Group expressjs/discussions#165
Closed
This was referenced Mar 4, 2024
Express.js Threat Model expressjs/security-wg#3
Closed
Add a Threat Model expressjs/express#5526
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tniessen tniessen tniessen left review comments
@aduh95 aduh95 aduh95 left review comments
@mcollina mcollina mcollina approved these changes
@jasnell jasnell jasnell approved these changes
@Trott Trott Trott approved these changes
@anonrig anonrig anonrig approved these changes
@UlisesGascon UlisesGascon UlisesGascon approved these changes
@gireeshpunathil gireeshpunathil Awaiting requested review from gireeshpunathil
@VoltrexKeyva VoltrexKeyva Awaiting requested review from VoltrexKeyva
+1 more reviewer
@mhdawson mhdawson mhdawson approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

doc Issues and PRs related to Node.js documentation.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

13 participants

@RafaelGSS @Trott @mhdawson @nodejs-github-bot @mcollina @jasnell @anonrig @tniessen @UlisesGascon @gireeshpunathil @aduh95 @VoltrexKeyva @GeoffreyBooth
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.