3 ms·
It seems that there is a JS context per worker and the workers are shared among different requests. Further, the requests are handled by simple string formattin
by xucheng 6y ago
It seems that there is a JS context per worker and the workers are shared among different requests. Further, the requests are handled by simple string formatting and eval in the JS context. This means that it should be trivial to inject arbitrary js codes in the server and initiate a XSS attack.
- jgalvez 6y agoEach thread runs the renderer sequentially, which means we can share a VueRouter instance between them as well. At least so far haven't seen any issues with it. This is highly experimental, just a proof-of-concept so far. Security issues need to be reviewed and addressed for sure.
- spankalee 6y agoClient side code can assume a single-user context. It could write user-specific values to globals, use them in modules, etc., and it would be fine on the client side. But run in a multi-user environment it would be relatively easy to leak data from one user to another. SSR should run each request, or at least session, in a fresh context.
- jgalvez 6y agoThat would be the case in a typical Node setting, but in this case, each thread runs the renderer no more than once at a time. So we just have to provide a fresh state.