Tobias Nießen 4aa0eff787 policy: disable process.binding() when enabled ...

process.binding() can be used to trivially bypass restrictions imposed
through a policy. Since the function is deprecated already, simply
replace it with a stub when a policy is being enabled.

Fixes: https://hackerone.com/bugs?report_id=1946470
PR-URL: https://github.com/nodejs-private/node-private/pull/397
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2023-32559

2023-08-09 14:29:06 -03:00

..

esm_loader.js

esm: add back globalPreload tests and fix failing ones

2023-07-17 17:26:15 +02:00

execution.js

lib: add trailing commas in internal/process

2023-02-18 18:56:43 +01:00

per_thread.js

lib: add trailing commas in internal/process

2023-02-18 18:56:43 +01:00

permission.js

permission: handle fs path traversal

2023-06-20 17:31:47 -03:00

policy.js

policy: disable process.binding() when enabled

2023-08-09 14:29:06 -03:00

pre_execution.js

lib,permission: restrict process.binding when pm is enabled

2023-08-09 14:28:39 -03:00

promises.js

lib: add trailing commas in internal/process

2023-02-18 18:56:43 +01:00

report.js

permission: v8.writeHeapSnapshot and process.report

2023-07-04 13:12:48 +00:00

signal.js

lib: add trailing commas in internal/process

2023-02-18 18:56:43 +01:00

task_queues.js

lib: add trailing commas in internal/process

2023-02-18 18:56:43 +01:00

warning.js

process: runtime deprecate coercion to integer in process.exit()

2022-10-07 13:26:12 +00:00

worker_thread_only.js

lib: add trailing commas in internal/process

2023-02-18 18:56:43 +01:00