4 ms·

Consider a web server serving multiple ongoing requests from different users (with separate permissions). Each of them uses a buffer at some point (either a Buf

Consider a web server serving multiple ongoing requests from different users (with separate permissions). Each of them uses a buffer at some point (either a Buffer or a Uint8Array) If the buffer doesn't have any cross-contamination with global state, there's no way one user could access another's data (because it's behind an object reference that never comes into the scope of the request logic for the other user). But if it did, and a malicious user found some other kind of vulnerability, they could potentially access data across-scopes

kklisura 3y ago
Replace buffer in your example with plain object or just array - that rest of it still stands, right? There's something other at play: > buffers expose private information through global variables, a potential security risk. This links to following piece of code [1]: > // Somewhere in your code > const privateBuf = Buffer.from(privateKey, 'hex'); > // Rogue package can access > Buffer.from('1').buffer I've just run it in node, and my god am I shocked! > const privateBuf = Buffer.from('DEADBEEF', 'hex'); > Buffer.from('1').buffer > ArrayBuffer { [Uint8Contents]: <2f 00 00 00 00 00 00 00 de ad be ef 00 > .... [1] https://github.com/nodejs/node/issues/41588#issuecomment-1016269584 https://github.com/nodejs/node/issues/41588#issuecomment-101...