Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

meta: clarify the threat model to explain the JSON.parse case #47276

Merged
merged 1 commit into from
Mar 30, 2023
Merged

meta: clarify the threat model to explain the JSON.parse case #47276

merged 1 commit into from
Mar 30, 2023

Conversation

mcollina
Copy link
Member

This PR clarifies our threat model to explain that JSON.parse(str) assumes that str is trusted.

@mcollina mcollina requested review from mhdawson and RafaelGSS March 28, 2023 06:50
@nodejs-github-bot nodejs-github-bot added the doc Issues and PRs related to the documentations. label Mar 28, 2023
@anonrig anonrig added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. commit-queue Add this label to land a pull request using GitHub Actions. labels Mar 28, 2023
mhdawson
mhdawson approved these changes Mar 28, 2023
View reviewed changes
Copy link
Member

@mhdawson mhdawson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

cjihrig
cjihrig approved these changes Mar 28, 2023
View reviewed changes
SECURITY.md Outdated Show resolved Hide resolved
tniessen
tniessen approved these changes Mar 28, 2023
View reviewed changes
SECURITY.md Show resolved Hide resolved
RafaelGSS
RafaelGSS approved these changes Mar 28, 2023
View reviewed changes
Copy link
Member

@RafaelGSS RafaelGSS left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with above suggestions.

@nodejs-github-bot nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels Mar 30, 2023
@nodejs-github-bot
Copy link
Collaborator

Commit Queue failed
- Loading data for nodejs/node/pull/47276
✔  Done loading data for nodejs/node/pull/47276
----------------------------------- PR info ------------------------------------
Title      meta: clarify the threat model to explain the JSON.parse case (#47276)
Author     Matteo Collina  (@mcollina)
Branch     mcollina:security-model-updates -> nodejs:main
Labels     doc, author ready
Commits    3
 - meta: clarify the threat model to explain the JSON.parse case
 - Update SECURITY.md
 - Update SECURITY.md
Committers 2
 - Matteo Collina 
 - GitHub 
PR-URL: https://github.com/nodejs/node/pull/47276
Reviewed-By: Michaël Zasso 
Reviewed-By: Yagiz Nizipli 
Reviewed-By: Michael Dawson 
Reviewed-By: Colin Ihrig 
Reviewed-By: Tobias Nießen 
Reviewed-By: Rafael Gonzaga 
Reviewed-By: Luigi Pinca 
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/47276
Reviewed-By: Michaël Zasso 
Reviewed-By: Yagiz Nizipli 
Reviewed-By: Michael Dawson 
Reviewed-By: Colin Ihrig 
Reviewed-By: Tobias Nießen 
Reviewed-By: Rafael Gonzaga 
Reviewed-By: Luigi Pinca 
--------------------------------------------------------------------------------
   ⚠  Commits were pushed since the last review:
   ⚠  - Update SECURITY.md
   ⚠  - Update SECURITY.md
   ℹ  This PR was created on Tue, 28 Mar 2023 06:50:11 GMT
   ✔  Approvals: 7
   ✔  - Michaël Zasso (@targos) (TSC): https://github.com/nodejs/node/pull/47276#pullrequestreview-1360430964
   ✔  - Yagiz Nizipli (@anonrig): https://github.com/nodejs/node/pull/47276#pullrequestreview-1360903524
   ✔  - Michael Dawson (@mhdawson) (TSC): https://github.com/nodejs/node/pull/47276#pullrequestreview-1361060010
   ✔  - Colin Ihrig (@cjihrig) (TSC): https://github.com/nodejs/node/pull/47276#pullrequestreview-1361063434
   ✔  - Tobias Nießen (@tniessen) (TSC): https://github.com/nodejs/node/pull/47276#pullrequestreview-1361358121
   ✔  - Rafael Gonzaga (@RafaelGSS) (TSC): https://github.com/nodejs/node/pull/47276#pullrequestreview-1361672911
   ✔  - Luigi Pinca (@lpinca): https://github.com/nodejs/node/pull/47276#pullrequestreview-1361699799
   ✘  Last GitHub CI failed
   ℹ  Green GitHub CI is sufficient
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu
https://github.com/nodejs/node/actions/runs/4561490045

@targos
Copy link
Member

targos commented Mar 30, 2023 

SECURITY.md
Warning:   128:82  warning  Line must be at most 80 characters  maximum-line-length  remark-lint

@mcollina
Copy link
Member Author

Updated, PTAL

@mcollina mcollina force-pushed the security-model-updates branch from 621585a to b1dac8d Compare March 30, 2023 07:07
@mcollina mcollina added commit-queue Add this label to land a pull request using GitHub Actions. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. and removed commit-queue-failed An error occurred while landing this pull request using GitHub Actions. labels Mar 30, 2023
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 30, 2023
@nodejs-github-bot nodejs-github-bot merged commit 42c4a35 into nodejs:main Mar 30, 2023
@nodejs-github-bot
Copy link
Collaborator

Landed in 42c4a35

@RafaelGSS RafaelGSS mentioned this pull request Apr 3, 2023
Merged
RafaelGSS pushed a commit that referenced this pull request Apr 5, 2023
@mcollina @RafaelGSS
meta: clarify the threat model to explain the JSON.parse case
0985548 
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #47276
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
@RafaelGSS RafaelGSS mentioned this pull request Apr 6, 2023
Merged
RafaelGSS pushed a commit that referenced this pull request Apr 6, 2023
@mcollina @RafaelGSS
meta: clarify the threat model to explain the JSON.parse case
72e8bd3 
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #47276
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
RafaelGSS pushed a commit that referenced this pull request Apr 7, 2023
@mcollina @RafaelGSS
meta: clarify the threat model to explain the JSON.parse case
2c95f6e 
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #47276
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
danielleadams pushed a commit that referenced this pull request Jul 6, 2023
@mcollina @danielleadams
meta: clarify the threat model to explain the JSON.parse case
e859ca4 
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #47276
Reviewed-By: Michaël Zasso <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
@danielleadams danielleadams mentioned this pull request Jul 10, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@RafaelGSS RafaelGSS RafaelGSS approved these changes

@mhdawson mhdawson mhdawson approved these changes

@tniessen tniessen tniessen approved these changes

@cjihrig cjihrig cjihrig approved these changes

@targos targos targos approved these changes

@anonrig anonrig anonrig approved these changes

@lpinca lpinca lpinca approved these changes

Assignees
No one assigned
Labels
author ready PRs that have at least one approval, no pending requests for changes, and a CI started. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. doc Issues and PRs related to the documentations.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
9 participants
@mcollina @nodejs-github-bot @targos @lpinca @anonrig @cjihrig @tniessen @mhdawson @RafaelGSS