3 ms·
Yeah, we've had this as well... for example, if you're running a certain version of node, you might have a CVE on the crypto module but if your API just accepts
by WrtCdEvrydy 6y ago
Yeah, we've had this as well... for example, if you're running a certain version of node, you might have a CVE on the crypto module but if your API just accepts some data, processes some data and writes it to a local file without using crypto... are you really vulnerable?
- Sebb767 6y agoIt depends. Of course, if i.e. a malicious ciphertext can do an RCE, the app right now is not vulnerable. But at some point you might let the user backup his encrypted data and restore it. You colleague knows you already have the code, it's only decrypting the data, you checked it for security, what could go wrong? Of course, you shouldn't panic just because this issue exists, especially if you know it does not affect you right now. But leaving this unattended, especially without the huge exclaimer that you can not accept untrusted ciphertext, can easily come back to bite you. Maybe it was exactly what caused this (theoretical) issue in the first place.