Skip to content

doc: add Node.js Threat Model - #45223

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
RafaelGSS:add-threat-model
Nov 21, 2022
Merged

doc: add Node.js Threat Model#45223
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
RafaelGSS:add-threat-model

Conversation

@RafaelGSS

@RafaelGSSRafaelGSS commented Oct 28, 2022

Copy link
Copy Markdown
Member

Reference: nodejs/security-wg#799
Following up: nodejs/nodejs.org#4896

This is another Security WG initiative. We've been actively working on that and finally, we have something to share.

This document was created aiming to provide context on what will/will not be considered a vulnerability in Node.js, targeting Security Researchers, as well as serve as a guide for application security operations in support of development teams building on top of the Node.js platform.

cc: @nodejs/security @nodejs/security-wg @nodejs/tsc

Co-authored-by: Michael Dawson midawson@redhat.com
Co-authored-by: Facundo Tuesca facundo.tuesca@trailofbits.com
Co-authored-by: Ulises Gascon UlisesGascon@users.noreply.github.com
Co-authored-by: Thomas Gentilhomme gentilhomme.thomas@gmail.com

@nodejs-github-botnodejs-github-bot added the doc Issues and PRs related to the documentations. label Oct 28, 2022
RafaelGSS
RafaelGSS commented Oct 28, 2022
View reviewed changes
Comment threadSECURITY.md Outdated

@RafaelGSSRafaelGSSOct 28, 2022

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're assessing if that's a blocker for this PR or it can land without a documentation update for now.

@mhdawsonmhdawsonOct 28, 2022

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My current take is that we are documenting/agreeing on what we should do with vulnerabilty reports. As soon as we agree I'm thinking we should take reports, I don't think we load all that many files and if we don't have them documented and people want to help identify them for us, that's not necessarily bad.

Trott
Trott reviewed Oct 28, 2022
View reviewed changes
Comment threadSECURITY.md Outdated
Trott
Trott reviewed Oct 28, 2022
View reviewed changes
Comment threadSECURITY.md Outdated
@Trott

This comment was marked as resolved.

Sign in to view
@Trott

This comment was marked as resolved.

Sign in to view
Trott
Trott reviewed Oct 28, 2022
View reviewed changes
Comment threadSECURITY.md Outdated
VoltrexKeyva
VoltrexKeyva reviewed Oct 28, 2022
View reviewed changes
Comment threadSECURITY.md Outdated
mhdawson
mhdawson reviewed Oct 28, 2022
View reviewed changes
Comment threadSECURITY.md Outdated
@mhdawsonmhdawson added the tsc-agenda Issues and PRs to discuss during the meetings of the TSC. label Oct 31, 2022
@mhdawson

mhdawson commented Oct 31, 2022

Copy link
Copy Markdown
Member

Putting on TSC agenda for awareness.

@mhdawsonmhdawson mentioned this pull request Oct 31, 2022
Closed
mcollina
mcollina requested changes Nov 2, 2022
View reviewed changes

@mcollinamcollina left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please list some good examples of vulnerabilities?

Comment threadSECURITY.md Outdated
Comment threadSECURITY.md Outdated
Comment threadSECURITY.md Outdated
@mhdawson

mhdawson commented Nov 3, 2022

Copy link
Copy Markdown
Member

@RafaelGSS sorry I meant to add the examples as a set of suggested changes but ended up pushing directly.

@mhdawson

mhdawson commented Nov 3, 2022

Copy link
Copy Markdown
Member

@mcollina added examples as requested.

mhdawson
mhdawson reviewed Nov 3, 2022
View reviewed changes
Comment threadSECURITY.md Outdated
mhdawson
mhdawson reviewed Nov 3, 2022
View reviewed changes
Comment threadSECURITY.md Outdated
gireeshpunathil
gireeshpunathil reviewed Nov 4, 2022
View reviewed changes
Comment threadSECURITY.md Outdated
Trott
Trott reviewed Nov 5, 2022
View reviewed changes
Comment threadSECURITY.md Outdated
This was referenced Nov 7, 2022
Closed
Closed
@RafaelGSS
RafaelGSSforce-pushed the add-threat-model branch 2 times, most recently from 5ba7ef6 to 0216617CompareNovember 9, 2022 19:43
@RafaelGSS@mhdawson
@facutuesca@UlisesGascon@fraxken
doc: add Node.js Threat Model
8e7ea63
Co-authored-by: Michael Dawson <midawson@redhat.com>
Co-authored-by: Facundo Tuesca <facundo.tuesca@trailofbits.com>
Co-authored-by: Ulises Gascon <UlisesGascon@users.noreply.github.com>
Co-authored-by: Thomas Gentilhomme <gentilhomme.thomas@gmail.com>
@BethGriggsBethGriggs mentioned this pull request Nov 16, 2022
Closed
@RafaelGSSRafaelGSS added the commit-queue Add this label to land a pull request using GitHub Actions. label Nov 21, 2022
@nodejs-github-botnodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Nov 21, 2022
@nodejs-github-bot
nodejs-github-bot merged commit 487fa8a into nodejs:mainNov 21, 2022
@nodejs-github-bot

nodejs-github-bot commented Nov 21, 2022

Copy link
Copy Markdown
Collaborator

Landed in 487fa8a

tniessen added a commit to tniessen/node that referenced this pull request Nov 21, 2022
@tniessen
doc: fix typo in threat model
3900ae7
Refs: nodejs#45223
@tniessentniessen mentioned this pull request Nov 21, 2022
Merged
nodejs-github-bot pushed a commit that referenced this pull request Nov 21, 2022
@tniessen
doc: fix typo in threat model
ccd3a42
Refs: #45223
PR-URL: #45558
Reviewed-By: Harshitha K P <harshitha014@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
ruyadorno pushed a commit that referenced this pull request Nov 21, 2022
@RafaelGSS@mhdawson
@facutuesca@UlisesGascon@fraxken@ruyadorno
doc: add Node.js Threat Model
5b1df22
Co-authored-by: Michael Dawson <midawson@redhat.com>
Co-authored-by: Facundo Tuesca <facundo.tuesca@trailofbits.com>
Co-authored-by: Ulises Gascon <UlisesGascon@users.noreply.github.com>
Co-authored-by: Thomas Gentilhomme <gentilhomme.thomas@gmail.com>
PR-URL: #45223
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
ruyadorno pushed a commit that referenced this pull request Nov 21, 2022
@tniessen@ruyadorno
doc: fix typo in threat model
246cd35
Refs: #45223
PR-URL: #45558
Reviewed-By: Harshitha K P <harshitha014@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
@ruyadornoruyadorno mentioned this pull request Nov 24, 2022
Merged
@danielleadamsdanielleadams mentioned this pull request Dec 30, 2022
Merged
danielleadams pushed a commit that referenced this pull request Dec 30, 2022
@RafaelGSS@mhdawson
@facutuesca@UlisesGascon@fraxken@danielleadams
doc: add Node.js Threat Model
6128cf1
Co-authored-by: Michael Dawson <midawson@redhat.com>
Co-authored-by: Facundo Tuesca <facundo.tuesca@trailofbits.com>
Co-authored-by: Ulises Gascon <UlisesGascon@users.noreply.github.com>
Co-authored-by: Thomas Gentilhomme <gentilhomme.thomas@gmail.com>
PR-URL: #45223
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
danielleadams pushed a commit that referenced this pull request Dec 30, 2022
@tniessen@danielleadams
doc: fix typo in threat model
c2c7b8d
Refs: #45223
PR-URL: #45558
Reviewed-By: Harshitha K P <harshitha014@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
danielleadams pushed a commit that referenced this pull request Jan 3, 2023
@RafaelGSS@mhdawson
@facutuesca@UlisesGascon@fraxken@danielleadams
doc: add Node.js Threat Model
e851c43
Co-authored-by: Michael Dawson <midawson@redhat.com>
Co-authored-by: Facundo Tuesca <facundo.tuesca@trailofbits.com>
Co-authored-by: Ulises Gascon <UlisesGascon@users.noreply.github.com>
Co-authored-by: Thomas Gentilhomme <gentilhomme.thomas@gmail.com>
PR-URL: #45223
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
danielleadams pushed a commit that referenced this pull request Jan 3, 2023
@tniessen@danielleadams
doc: fix typo in threat model
31233b2
Refs: #45223
PR-URL: #45558
Reviewed-By: Harshitha K P <harshitha014@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
danielleadams pushed a commit that referenced this pull request Jan 5, 2023
@RafaelGSS@mhdawson
@facutuesca@UlisesGascon@fraxken@danielleadams
doc: add Node.js Threat Model
33a2419
Co-authored-by: Michael Dawson <midawson@redhat.com>
Co-authored-by: Facundo Tuesca <facundo.tuesca@trailofbits.com>
Co-authored-by: Ulises Gascon <UlisesGascon@users.noreply.github.com>
Co-authored-by: Thomas Gentilhomme <gentilhomme.thomas@gmail.com>
PR-URL: #45223
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
danielleadams pushed a commit that referenced this pull request Jan 5, 2023
@tniessen@danielleadams
doc: fix typo in threat model
f743fe6
Refs: #45223
PR-URL: #45558
Reviewed-By: Harshitha K P <harshitha014@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
@wesleytoddwesleytodd mentioned this pull request Mar 2, 2024
Closed
This was referenced Mar 4, 2024
Closed
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tniessentniessentniessen left review comments
@aduh95aduh95aduh95 left review comments
@mcollinamcollinamcollina approved these changes
@jasnelljasnelljasnell approved these changes
@TrottTrottTrott approved these changes
@anonriganonriganonrig approved these changes
@UlisesGasconUlisesGasconUlisesGascon approved these changes
@gireeshpunathilgireeshpunathilAwaiting requested review from gireeshpunathil
@VoltrexKeyvaVoltrexKeyvaAwaiting requested review from VoltrexKeyva
+1 more reviewer
@mhdawsonmhdawsonmhdawson approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

docIssues and PRs related to the documentations.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

13 participants

@RafaelGSS@Trott@mhdawson@nodejs-github-bot@mcollina@jasnell@anonrig@tniessen@UlisesGascon@gireeshpunathil@aduh95@VoltrexKeyva@GeoffreyBooth