archive/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2025-08-15 13:48:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

doc: add path.join and path.normalize clarification

Browse source 
This commit adds explicit clarification to the Node.js threat model
that path manipulation functions such as path.join() and
path.normalize()
trust their input. Issues related to these functions that rely on
unsanitized input are not considered vulnerabilities requiring CVEs.

PR-URL: https://github.com/nodejs/node/pull/59262
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
This commit is contained in:
Rafael Gonzaga 2025-07-30 16:01:40 -03:00 • committed by RafaelGSS
parent 5b2363be8d
commit 31a46fdeb4
No known key found for this signature in database
GPG key ID: 8BEAB4DFCF555EF4
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
SECURITY.md
View file

@ -179,6 +179,11 @@ then untrusted input must not lead to arbitrary JavaScript code execution.
See <https://nodejs.org/api/modules.html#all-together>.
* The `node:wasi` module does not currently provide the comprehensive file
system security properties provided by some WASI runtimes.
* The execution path is trusted. Additionally, Node.js path manipulation functions
such as `path.join()` and `path.normalize()` trust their input. Reports about issues
related to these functions that rely on unsanitized input are not considered vulnerabilities
requiring CVEs, as it's the user's responsibility to sanitize path inputs according to
their security requirements.
Any unexpected behavior from the data manipulation from Node.js Internal
functions may be considered a vulnerability if they are exploitable via