Tobias Nießen 4aa0eff787 policy: disable process.binding() when enabled ...

process.binding() can be used to trivially bypass restrictions imposed
through a policy. Since the function is deprecated already, simply
replace it with a stub when a policy is being enabled.

Fixes: https://hackerone.com/bugs?report_id=1946470
PR-URL: https://github.com/nodejs-private/node-private/pull/397
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2023-32559

2023-08-09 14:29:06 -03:00

..

assert

…

dns

…

fs

…

inspector

…

internal

policy: disable process.binding() when enabled

2023-08-09 14:29:06 -03:00

path

…

readline

readline: use addAbortListener

2023-07-11 19:50:13 +03:00

stream

…

test

…

timers

fs: use kResistStopPropagation

2023-06-24 15:52:38 +00:00

util

…

_http_agent.js

…

_http_client.js

…

_http_common.js

http: null the joinDuplicateHeaders property on cleanup

2023-07-03 06:20:13 +00:00

_http_incoming.js

…

_http_outgoing.js

http: send implicit headers on HEAD with no body

2023-05-26 12:38:24 +00:00

_http_server.js

http: start connections checking interval on listen

2023-07-24 20:55:19 +00:00

_stream_duplex.js

…

_stream_passthrough.js

…

_stream_readable.js

…

_stream_transform.js

…

_stream_wrap.js

…

_stream_writable.js

…

_tls_common.js

…

_tls_wrap.js

tls: fix bugs of double TLS

2023-08-04 10:14:18 -04:00

.eslintrc.yaml

lib: add navigator.hardwareConcurrency

2023-07-04 22:55:34 +00:00

assert.js

assert: deprecate callTracker

2023-04-29 06:57:08 +00:00

async_hooks.js

…

buffer.js

buffer: combine checking range of sourceStart in buf.copy

2023-05-07 23:58:41 +00:00

child_process.js

typings: update JSDoc for cwd in child_process

2023-08-08 15:32:31 +08:00

cluster.js

cluster: use ObjectPrototypeHasOwnProperty

2023-05-25 16:04:19 +00:00

console.js

…

constants.js

…

crypto.js

…

dgram.js

dgram: socket add asyncDispose

2023-07-11 21:10:27 +00:00

diagnostics_channel.js

diagnostics_channel: fix last subscriber removal

2023-07-31 10:13:59 -07:00

dns.js

dns: call ada::idna::to_ascii directly from c++

2023-05-10 16:04:35 +00:00

domain.js

…

events.js

events: fix bug listenerCount don't compare wrapped listener

2023-07-10 06:33:51 +00:00

fs.js

fs: make mkdtemp accept buffers and URL

2023-07-26 19:32:31 +08:00

http2.js

…

http.js

http: prevent writing to the body when not allowed by HTTP spec

2023-05-13 17:09:26 +00:00

https.js

http: start connections checking interval on listen

2023-07-24 20:55:19 +00:00

inspector.js

inspector: open add SymbolDispose

2023-07-16 09:46:27 +00:00

module.js

module: implement register utility

2023-06-12 00:00:46 +00:00

net.js

net: server add asyncDispose

2023-07-11 21:10:28 +00:00

os.js

tools: fix jsdoc lint

2023-05-02 00:48:20 +00:00

path.js

path: indicate index of wrong resolve() parameter

2023-05-04 14:03:20 +00:00

perf_hooks.js

…

process.js

…

punycode.js

lib: runtime deprecate punycode

2023-04-03 17:47:28 +00:00

querystring.js

…

readline.js

readline: use addAbortListener

2023-07-11 19:50:13 +03:00

repl.js

repl: display dynamic import variant in static import error messages

2023-06-11 08:10:39 +00:00

stream.js

…

string_decoder.js

tools: fix jsdoc lint

2023-05-02 00:48:20 +00:00

sys.js

…

test.js

test_runner: add initial draft for fakeTimers

2023-06-22 04:01:52 +00:00

timers.js

timers: support Symbol.dispose

2023-07-05 13:39:38 +00:00

tls.js

…

trace_events.js

…

tty.js

…

url.js

lib: remove invalid parameter to toASCII

2023-07-22 00:52:20 +00:00

util.js

tools: fix jsdoc lint

2023-05-02 00:48:20 +00:00

v8.js

src: make AliasedBuffers in the binding data weak

2023-04-20 03:28:35 +00:00

vm.js

vm,lib: refactor microtaskQueue assignment logic

2023-05-13 22:17:05 +08:00

wasi.js

wasi: make returnOnExit true by default

2023-04-11 16:35:52 -04:00

worker_threads.js

src: throw DataCloneError on transfering untransferable objects

2023-05-05 11:22:42 +00:00

zlib.js

…