Tobias Nießen e673c03629 policy: use tamper-proof integrity check function ...

Using the JavaScript Hash class is unsafe because its internals can be
tampered with. In particular, an application can cause
Hash.prototype.digest() to return arbitrary values, thus allowing to
circumvent the integrity verification that policies are supposed to
guarantee.

Add and use a new C++ binding internalVerifyIntegrity() that (hopefully)
cannot be tampered with from JavaScript.

PR-URL: https://github.com/nodejs-private/node-private/pull/462
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2023-38552

2023-10-13 18:03:19 -03:00

..

manifest.js

policy: use tamper-proof integrity check function

2023-10-13 18:03:19 -03:00

sri.js

lib: enforce use of trailing commas in more files

2023-02-16 18:47:24 +01:00