4 ms·

> buffers expose private information through global variables, a potential security risk. Does JavaScript's security model let you effectively sandbox scripts

> buffers expose private information through global variables, a potential security risk. Does JavaScript's security model let you effectively sandbox scripts running in the same context from each other? If not, then why does this matter?

strken 3y ago
From a cursory read, it matters because all Buffer.from(...) calls use a shared buffer, and buffer over-reads are a much more common vulnerability than easy access to arbitrary memory. Not a security expert etc.
brundolf 3y ago
Consider a web server serving multiple ongoing requests from different users (with separate permissions). Each of them uses a buffer at some point (either a Buffer or a Uint8Array) If the buffer doesn't have any cross-contamination with global state, there's no way one user could access another's data (because it's behind an object reference that never comes into the scope of the request logic for the other user). But if it did, and a malicious user found some other kind of vulnerability, they could potentially access data across-scopes
- kklisura 3y ago
  Replace buffer in your example with plain object or just array - that rest of it still stands, right? There's something other at play: > buffers expose private information through global variables, a potential security risk. This links to following piece of code [1]: > // Somewhere in your code > const privateBuf = Buffer.from(privateKey, 'hex'); > // Rogue package can access > Buffer.from('1').buffer I've just run it in node, and my god am I shocked! > const privateBuf = Buffer.from('DEADBEEF', 'hex'); > Buffer.from('1').buffer > ArrayBuffer { [Uint8Contents]: <2f 00 00 00 00 00 00 00 de ad be ef 00 > .... [1] https://github.com/nodejs/node/issues/41588#issuecomment-1016269584 https://github.com/nodejs/node/issues/41588#issuecomment-101...

4 ms·

> buffers expose private information through global variables, a potential security risk. Does JavaScript's security model let you effectively sandbox scripts

by josephcsible 3y ago

strken 3y ago
From a cursory read, it matters because all Buffer.from(...) calls use a shared buffer, and buffer over-reads are a much more common vulnerability than easy access to arbitrary memory. Not a security expert etc.
brundolf 3y ago
Consider a web server serving multiple ongoing requests from different users (with separate permissions). Each of them uses a buffer at some point (either a Buffer or a Uint8Array) If the buffer doesn't have any cross-contamination with global state, there's no way one user could access another's data (because it's behind an object reference that never comes into the scope of the request logic for the other user). But if it did, and a malicious user found some other kind of vulnerability, they could potentially access data across-scopes
- kklisura 3y ago
  Replace buffer in your example with plain object or just array - that rest of it still stands, right? There's something other at play: > buffers expose private information through global variables, a potential security risk. This links to following piece of code [1]: > // Somewhere in your code > const privateBuf = Buffer.from(privateKey, 'hex'); > // Rogue package can access > Buffer.from('1').buffer I've just run it in node, and my god am I shocked! > const privateBuf = Buffer.from('DEADBEEF', 'hex'); > Buffer.from('1').buffer > ArrayBuffer { [Uint8Contents]: <2f 00 00 00 00 00 00 00 de ad be ef 00 > .... [1] https://github.com/nodejs/node/issues/41588#issuecomment-1016269584 https://github.com/nodejs/node/issues/41588#issuecomment-101...