4 ms·

Make your application directory read-only to the user running the application, as it ought to be anyway. Automatic dependency resolution however... Fantastic f

by adrusi 8y ago

Make your application directory read-only to the user running the application, as it ought to be anyway. Automatic dependency resolution however... Fantastic for experimentation, but that's a dealbreaker for production. Maybe it would be OK if it actually wrote the package-lock.json to the application directory, I'd have to think about that.

SahAssar 8y ago
In this case the application also tries to auto-install dependencies, so making it read-only removes one of the stated features. I think this framework hasn't been written with security in mind at all.
- adrusi 8y ago
  Whatever it's doing, it's not writing the packages into the application directory.
  - SahAssar 8y ago
    If it can write to the applications dependencies isn't that as good as writing to the application?