Skip to content

Commit bd7443a

Browse files
committed
lib,permission: restrict process.binding when pm is enabled
PR-URL: nodejs-private/node-private#438 Fixes: nodejs-private/node-private#422 CVE-ID: CVE-2023-32558
1 parent ae25da2 commit bd7443a

File tree

3 files changed

+58
-0
lines changed

3 files changed

+58
-0
lines changed

lib/internal/process/pre_execution.js

+4
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ const {
3333
ERR_MANIFEST_ASSERT_INTEGRITY,
3434
ERR_NO_CRYPTO,
3535
ERR_MISSING_OPTION,
36+
ERR_ACCESS_DENIED,
3637
} = require('internal/errors').codes;
3738
const assert = require('internal/assert');
3839
const {
@@ -536,6 +537,9 @@ function initializeClusterIPC() {
536537
function initializePermission() {
537538
const experimentalPermission = getOptionValue('--experimental-permission');
538539
if (experimentalPermission) {
540+
process.binding = function binding(_module) {
541+
throw new ERR_ACCESS_DENIED('process.binding');
542+
};
539543
process.emitWarning('Permission is an experimental feature',
540544
'ExperimentalWarning');
541545
const { has, deny } = require('internal/process/permission');
+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
const common = require('../../common');
2+
common.skipIfWorker();
3+
4+
const assert = require('assert');
5+
6+
{
7+
assert.throws(() => {
8+
process.binding();
9+
}, common.expectsError({
10+
code: 'ERR_ACCESS_DENIED',
11+
}));
12+
}
13+
14+
{
15+
assert.throws(() => {
16+
process.binding('async_wrap');
17+
}, common.expectsError({
18+
code: 'ERR_ACCESS_DENIED',
19+
}));
20+
}
21+
22+
{
23+
assert.throws(() => {
24+
process.binding('fs');
25+
}, common.expectsError({
26+
code: 'ERR_ACCESS_DENIED',
27+
}));
28+
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
'use strict';
2+
3+
const common = require('../common');
4+
common.skipIfWorker();
5+
6+
if (!common.hasCrypto) {
7+
common.skip('no crypto');
8+
}
9+
10+
const { spawnSync } = require('child_process');
11+
const assert = require('assert');
12+
const fixtures = require('../common/fixtures');
13+
const file = fixtures.path('permission', 'processbinding.js');
14+
15+
// Due to linting rules-utils.js:isBinding check, process.binding() should
16+
// not be called when --experimental-permission is enabled.
17+
// Always spawn a child process
18+
{
19+
const { status, stderr } = spawnSync(
20+
process.execPath,
21+
[
22+
'--experimental-permission', '--allow-fs-read=*', file,
23+
],
24+
);
25+
assert.strictEqual(status, 0, stderr.toString());
26+
}

0 commit comments

Comments
 (0)