doc: add Node.js Threat Model #45223

RafaelGSS · 2022-10-28T13:48:00Z

Reference: nodejs/security-wg#799
Following up: nodejs/nodejs.org#4896

This is another Security WG initiative. We've been actively working on that and finally, we have something to share.

This document was created aiming to provide context on what will/will not be considered a vulnerability in Node.js, targeting Security Researchers, as well as serve as a guide for application security operations in support of development teams building on top of the Node.js platform.

cc: @nodejs/security @nodejs/security-wg @nodejs/tsc

Co-authored-by: Michael Dawson [email protected]
Co-authored-by: Facundo Tuesca [email protected]
Co-authored-by: Ulises Gascon [email protected]
Co-authored-by: Thomas Gentilhomme [email protected]

RafaelGSS · 2022-10-28T13:51:07Z

SECURITY.md

+performance.
+
+If Node.js loads configuration files or runs code by default (without a
+specific request from the user), and this is not documented, it is considered a


We're assessing if that's a blocker for this PR or it can land without a documentation update for now.

My current take is that we are documenting/agreeing on what we should do with vulnerabilty reports. As soon as we agree I'm thinking we should take reports, I don't think we load all that many files and if we don't have them documented and people want to help identify them for us, that's not necessarily bad.

SECURITY.md

mhdawson · 2022-10-31T18:34:20Z

Putting on TSC agenda for awareness.

mcollina

Can you please list some good examples of vulnerabilities?

SECURITY.md

mhdawson · 2022-11-03T20:48:47Z

@RafaelGSS sorry I meant to add the examples as a set of suggested changes but ended up pushing directly.

mhdawson · 2022-11-03T20:49:32Z

@mcollina added examples as requested.

SECURITY.md

Co-authored-by: Michael Dawson <[email protected]> Co-authored-by: Facundo Tuesca <[email protected]> Co-authored-by: Ulises Gascon <[email protected]> Co-authored-by: Thomas Gentilhomme <[email protected]>

nodejs-github-bot · 2022-11-21T11:13:50Z

Landed in 487fa8a

Refs: nodejs#45223

Refs: #45223 PR-URL: #45558 Reviewed-By: Harshitha K P <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Richard Lau <[email protected]>

Co-authored-by: Michael Dawson <[email protected]> Co-authored-by: Facundo Tuesca <[email protected]> Co-authored-by: Ulises Gascon <[email protected]> Co-authored-by: Thomas Gentilhomme <[email protected]> PR-URL: #45223 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]>

Refs: #45223 PR-URL: #45558 Reviewed-By: Harshitha K P <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Richard Lau <[email protected]>

Co-authored-by: Michael Dawson <[email protected]> Co-authored-by: Facundo Tuesca <[email protected]> Co-authored-by: Ulises Gascon <[email protected]> Co-authored-by: Thomas Gentilhomme <[email protected]> PR-URL: nodejs#45223 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]>

Refs: nodejs#45223 PR-URL: nodejs#45558 Reviewed-By: Harshitha K P <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Richard Lau <[email protected]>

Co-authored-by: Michael Dawson <[email protected]> Co-authored-by: Facundo Tuesca <[email protected]> Co-authored-by: Ulises Gascon <[email protected]> Co-authored-by: Thomas Gentilhomme <[email protected]> PR-URL: #45223 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]>

Refs: #45223 PR-URL: #45558 Reviewed-By: Harshitha K P <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Richard Lau <[email protected]>

Co-authored-by: Michael Dawson <[email protected]> Co-authored-by: Facundo Tuesca <[email protected]> Co-authored-by: Ulises Gascon <[email protected]> Co-authored-by: Thomas Gentilhomme <[email protected]> PR-URL: #45223 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]>

Refs: #45223 PR-URL: #45558 Reviewed-By: Harshitha K P <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Richard Lau <[email protected]>

Co-authored-by: Michael Dawson <[email protected]> Co-authored-by: Facundo Tuesca <[email protected]> Co-authored-by: Ulises Gascon <[email protected]> Co-authored-by: Thomas Gentilhomme <[email protected]> PR-URL: #45223 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]>

Refs: #45223 PR-URL: #45558 Reviewed-By: Harshitha K P <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Richard Lau <[email protected]>

Co-authored-by: Michael Dawson <[email protected]> Co-authored-by: Facundo Tuesca <[email protected]> Co-authored-by: Ulises Gascon <[email protected]> Co-authored-by: Thomas Gentilhomme <[email protected]> PR-URL: #45223 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]>

Refs: #45223 PR-URL: #45558 Reviewed-By: Harshitha K P <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Richard Lau <[email protected]>

Co-authored-by: Michael Dawson <[email protected]> Co-authored-by: Facundo Tuesca <[email protected]> Co-authored-by: Ulises Gascon <[email protected]> Co-authored-by: Thomas Gentilhomme <[email protected]> PR-URL: #45223 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]>

Refs: #45223 PR-URL: #45558 Reviewed-By: Harshitha K P <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Richard Lau <[email protected]>

nodejs-github-bot added the doc Issues and PRs related to the documentations. label Oct 28, 2022

RafaelGSS commented Oct 28, 2022

View reviewed changes

RafaelGSS force-pushed the add-threat-model branch from fc174c7 to 11b5dfb Compare October 28, 2022 14:14

Trott reviewed Oct 28, 2022

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

Trott reviewed Oct 28, 2022

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

This comment was marked as resolved.

Sign in to view

Trott reviewed Oct 28, 2022

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

VoltrexKeyva reviewed Oct 28, 2022

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

mhdawson reviewed Oct 28, 2022

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

RafaelGSS force-pushed the add-threat-model branch from 11b5dfb to 2626cbd Compare October 31, 2022 15:44

mhdawson added the tsc-agenda Issues and PRs to discuss during the meetings of the TSC. label Oct 31, 2022

mhdawson mentioned this pull request Oct 31, 2022

Node.js Technical Steering Committee (TSC) Meeting 2022-11-02 nodejs/TSC#1302

Closed

mcollina requested changes Nov 2, 2022

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

SECURITY.md Outdated Show resolved Hide resolved

SECURITY.md Outdated Show resolved Hide resolved

mhdawson reviewed Nov 3, 2022

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

mhdawson reviewed Nov 3, 2022

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

gireeshpunathil reviewed Nov 4, 2022

View reviewed changes

SECURITY.md Show resolved Hide resolved

Trott reviewed Nov 5, 2022

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

This was referenced Nov 7, 2022

Node.js Technical Steering Committee (TSC) Meeting 2022-11-09 nodejs/TSC#1304

Closed

Give access to @UlisesGascon to Mac OS test machines nodejs/build#3068

Closed

RafaelGSS force-pushed the add-threat-model branch 2 times, most recently from 5ba7ef6 to 0216617 Compare November 9, 2022 19:43

RafaelGSS requested review from mhdawson, mcollina, gireeshpunathil, Trott and VoltrexKeyva November 9, 2022 19:43

doc: add Node.js Threat Model

8e7ea63

Co-authored-by: Michael Dawson <[email protected]> Co-authored-by: Facundo Tuesca <[email protected]> Co-authored-by: Ulises Gascon <[email protected]> Co-authored-by: Thomas Gentilhomme <[email protected]>

RafaelGSS force-pushed the add-threat-model branch from 2da87c8 to 8e7ea63 Compare November 16, 2022 15:48

Trott approved these changes Nov 16, 2022

View reviewed changes

BethGriggs mentioned this pull request Nov 16, 2022

Nominating RafaelGSS to the TSC nodejs/TSC#1308

Closed

RafaelGSS added the commit-queue Add this label to land a pull request using GitHub Actions. label Nov 21, 2022

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Nov 21, 2022

nodejs-github-bot merged commit 487fa8a into nodejs:main Nov 21, 2022

tniessen added a commit to tniessen/node that referenced this pull request Nov 21, 2022

doc: fix typo in threat model

3900ae7

Refs: nodejs#45223

tniessen mentioned this pull request Nov 21, 2022

doc: fix typo in threat model #45558

Merged

ruyadorno mentioned this pull request Nov 24, 2022

v19.2.0 proposal #45615

Merged

danielleadams mentioned this pull request Dec 30, 2022

v18.13.0 release proposal #46025

Merged

wesleytodd mentioned this pull request Mar 2, 2024

Formation of a Security Working Group expressjs/discussions#165

Closed

This was referenced Mar 4, 2024

Express.js Threat Model expressjs/security-wg#3

Open

Add a Threat Model expressjs/express#5526

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

doc: add Node.js Threat Model #45223

doc: add Node.js Threat Model #45223

RafaelGSS commented Oct 28, 2022

RafaelGSS Oct 28, 2022

mhdawson Oct 28, 2022

This comment was marked as resolved.

This comment was marked as resolved.

mhdawson commented Oct 31, 2022

mcollina left a comment

mhdawson commented Nov 3, 2022

mhdawson commented Nov 3, 2022

nodejs-github-bot commented Nov 21, 2022

doc: add Node.js Threat Model #45223

doc: add Node.js Threat Model #45223

Conversation

RafaelGSS commented Oct 28, 2022

RafaelGSS Oct 28, 2022

Choose a reason for hiding this comment

mhdawson Oct 28, 2022

Choose a reason for hiding this comment

This comment was marked as resolved.

This comment was marked as resolved.

mhdawson commented Oct 31, 2022

mcollina left a comment

Choose a reason for hiding this comment

mhdawson commented Nov 3, 2022

mhdawson commented Nov 3, 2022

nodejs-github-bot commented Nov 21, 2022