4 ms·
Bit harsh? Log4j was caused by a URL leading to bad code being imported. This let's you import code via a URL, seems quite similar?
by moritonal 5y ago
Bit harsh? Log4j was caused by a URL leading to bad code being imported.
This let's you import code via a URL, seems quite similar?
- sodality2 5y agoLog4j was caused when arbitrary log strings were interpreted as code imports. In this case the flag has to be manually set and the code manually added as a dependency.
- anamexis 5y agoThe Log4j vulnerability allowed unsafe user input to trigger loading of arbitrary code. Basically every dependency manager out there will allow you to load "bad code" from a URL.
- tobyhinloopen 5y agoLog4j is no dependency manager
- anamexis 5y agoNo, it's not, but this new Node.js feature is for loading dependencies