OSSForks/node
1
0
Fork 0
mirror of https://github.com/zebrajr/node.git synced 2026-01-15 12:15:26 +00:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity

doc: explicit mention arbitrary code execution as a vuln

Browse Source 
This request came from Github Open Source Secure and
it's always welcome to clarify the policy

PR-URL: https://github.com/nodejs/node/pull/57426
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
This commit is contained in:
Rafael Gonzaga
2025-03-14 19:51:52 -03:00
committed by GitHub
parent 078af918d0
commit 645e376231
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
SECURITY.md
View File

@@ -106,6 +106,9 @@ a security vulnerability. Examples of unwanted actions are polluting globals,
causing an unrecoverable crash, or any other unexpected side effects that can
lead to a loss of confidentiality, integrity, or availability.
For example, if trusted input (like secure application code) is correct,
then untrusted input must not lead to arbitrary JavaScript code execution.
**Node.js trusts everything else**. Examples include:
* The developers and infrastructure that runs it.