Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
policy: makeRequireFunction on mainModule.require
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> Co-authored-by: Bradley Farias <bradley.meck@gmail.com> Backport-PR-URL: nodejs-private/node-private#373 Refs: https://hackerone.com/bugs?subject=nodejs&report_id=1747642 CVE-ID: CVE-2023-23918 PR-URL: nodejs-private/node-private#358 Reviewed-by: Bradley Farias <bradley.meck@gmail.com> Reviewed-by: Michael Dawson <midawson@redhat.com>
- Loading branch information
1 parent
fa115ee
commit 83975b7
Showing
10 changed files
with
158 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
process.mainModule.require('os').cpus(); |
19 changes: 19 additions & 0 deletions
19
test/fixtures/policy-manifest/object-define-property-bypass.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
let requires = new WeakMap() | ||
Object.defineProperty(Object.getPrototypeOf(module), 'require', { | ||
get() { | ||
return requires.get(this); | ||
}, | ||
set(v) { | ||
requires.set(this, v); | ||
process.nextTick(() => { | ||
let fs = Reflect.apply(v, this, ['fs']) | ||
if (typeof fs.readFileSync === 'function') { | ||
process.exit(1); | ||
} | ||
}) | ||
return requires.get(this); | ||
}, | ||
configurable: true | ||
}) | ||
|
||
require('./valid-module') |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
{ | ||
"onerror": "exit", | ||
"scopes": { | ||
"file:": { | ||
"integrity": true, | ||
"dependencies": {} | ||
} | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
{ | ||
"onerror": "exit", | ||
"resources": { | ||
"./object-define-property-bypass.js": { | ||
"integrity": true, | ||
"dependencies": { | ||
"./valid-module": true | ||
} | ||
}, | ||
"./valid-module.js": { | ||
"integrity": true, | ||
"dependencies": { | ||
"fs": true | ||
} | ||
} | ||
} | ||
} |
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,63 @@ | ||
'use strict'; | ||
|
||
const common = require('../common'); | ||
|
||
if (!common.hasCrypto) | ||
common.skip('missing crypto'); | ||
|
||
common.requireNoPackageJSONAbove(); | ||
|
||
const assert = require('assert'); | ||
const { spawnSync } = require('child_process'); | ||
const fixtures = require('../common/fixtures.js'); | ||
|
||
{ | ||
const policyFilepath = fixtures.path('policy-manifest', 'onerror-exit.json'); | ||
const result = spawnSync(process.execPath, [ | ||
'--experimental-policy', | ||
policyFilepath, | ||
'-e', | ||
'require("os").cpus()', | ||
]); | ||
|
||
assert.notStrictEqual(result.status, 0); | ||
const stderr = result.stderr.toString(); | ||
assert.match(stderr, /ERR_MANIFEST_DEPENDENCY_MISSING/); | ||
assert.match(stderr, /does not list os as a dependency specifier for conditions: require, node, node-addons/); | ||
} | ||
|
||
{ | ||
const policyFilepath = fixtures.path('policy-manifest', 'onerror-exit.json'); | ||
const mainModuleBypass = fixtures.path( | ||
'policy-manifest', | ||
'main-module-bypass.js', | ||
); | ||
const result = spawnSync(process.execPath, [ | ||
'--experimental-policy', | ||
policyFilepath, | ||
mainModuleBypass, | ||
]); | ||
|
||
assert.notStrictEqual(result.status, 0); | ||
const stderr = result.stderr.toString(); | ||
assert.match(stderr, /ERR_MANIFEST_DEPENDENCY_MISSING/); | ||
assert.match(stderr, /does not list os as a dependency specifier for conditions: require, node, node-addons/); | ||
} | ||
|
||
{ | ||
const policyFilepath = fixtures.path( | ||
'policy-manifest', | ||
'onerror-resource-exit.json', | ||
); | ||
const objectDefinePropertyBypass = fixtures.path( | ||
'policy-manifest', | ||
'object-define-property-bypass.js', | ||
); | ||
const result = spawnSync(process.execPath, [ | ||
'--experimental-policy', | ||
policyFilepath, | ||
objectDefinePropertyBypass, | ||
]); | ||
|
||
assert.strictEqual(result.status, 0); | ||
} |