Tobias Nießen 1dc0667aa6 doc: document dangerous symlink behavior ... Much earlier, a design decision was made that the permission model should not prevent following symbolic links to presumably inaccessible locations. Recently, after some back and forth, it had been decided that it is indeed a vulnerability that symbolic links, which currently point to an accessible location, can potentially be re-targeted to point to a presumably inaccessible location. Nevertheless, months later, no solution has been found and the issue is deemed unfixable in the context of the current permission model implementation, so it was decided to disclose the vulnerability and to shift responsibiliy onto users who are now responsible for ensuring that no potentially dangerous symlinks exist in any directories that they grant access to. I believe that this design issue might be surprising and that it comes with significant security implications for users, so it should be documented. Original vulnerability report: https://hackerone.com/reports/1961655 PR-URL: https://github.com/nodejs/node/pull/49154 Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>		2023-09-29 11:31:51 +00:00
..
addons.md	doc: cast GetInternalField() return type to v8::Value in addons.md	2023-09-07 08:51:00 +00:00
assert.md	doc: fix params names	2023-05-06 19:41:58 +00:00
async_context.md	2023-04-18, Version 20.0.0 (Current)	2023-04-18 13:04:39 -03:00
async_hooks.md	doc: declare path on example of async_hooks.executionAsyncId()	2023-07-18 20:00:50 +00:00
buffer.md	doc: clarify array args to Buffer.from()	2023-06-02 21:44:47 +00:00
child_process.md	2023-09-18, Version 18.18.0 'Hydrogen' (LTS)	2023-09-18 17:39:17 -04:00
cli.md	esm: --experimental-default-type flag to flip module defaults	2023-09-29 06:18:44 +00:00
cluster.md	doc: improve the documentation of the stdio option	2023-05-30 06:10:58 +00:00
console.md	doc: use serial comma in console docs	2022-05-31 14:57:50 +01:00
corepack.md	doc: update corepack.md to account for 0.20.0 changes	2023-09-16 11:52:30 +02:00
crypto.md	doc: update outdated reference to NIST SP 800-131A	2023-08-26 21:11:21 +00:00
debugger.md	debugger: improve validations and documents for watch and unwatch	2023-03-13 04:29:53 +00:00
deprecations.md	2023-09-28, Version 20.8.0 (Current)	2023-09-28 23:14:36 -04:00
dgram.md	2023-09-18, Version 18.18.0 'Hydrogen' (LTS)	2023-09-18 17:39:17 -04:00
diagnostics_channel.md	doc: fix typos	2023-04-23 13:34:08 +00:00
dns.md	2023-07-18, Version 18.17.0 'Hydrogen' (LTS)	2023-07-18 15:37:22 -04:00
documentation.md	doc: add experimental stages	2023-01-14 14:25:08 +00:00
domain.md	doc: fix typos	2023-04-23 13:34:08 +00:00
embedding.md	src: add detailed embedder process initialization API	2022-08-05 19:46:08 +00:00
errors.md	doc: fix history comments	2023-09-20 12:40:54 +00:00
esm.md	esm: --experimental-default-type flag to flip module defaults	2023-09-29 06:18:44 +00:00
events.md	doc: fix print results in events	2023-09-19 17:31:09 +00:00
fs.md	fs: adjust position validation in reading methods	2023-09-29 10:56:07 +00:00
globals.md	lib: add WebSocket client	2023-09-28 13:01:30 +00:00
http2.md	2023-07-05, Version 20.4.0 (Current)	2023-07-05 10:51:42 -03:00
http.md	deps: update llhttp to 9.1.2	2023-09-16 11:08:18 +00:00
https.md	doc: fix ambiguity in http.md and https.md	2023-07-12 16:25:27 +02:00
index.md	src: add initial support for single executable applications	2023-02-18 02:49:18 +00:00
inspector.md	2023-09-04, Version 20.6.0 (Current)	2023-09-04 15:01:52 -05:00
intl.md	doc: improve documentation about ICU data fallback	2023-09-22 13:24:23 +00:00
module.md	2023-09-28, Version 20.8.0 (Current)	2023-09-28 23:14:36 -04:00
modules.md	doc: use "file system" instead of "filesystem"	2023-01-14 01:10:38 +00:00
n-api.md	node-api: enable uncaught exceptions policy by default	2023-09-25 04:23:58 +00:00
net.md	2023-09-18, Version 18.18.0 'Hydrogen' (LTS)	2023-09-18 17:39:17 -04:00
os.md	doc: add riscv64 to list of architectures	2023-08-26 07:48:16 +02:00
packages.md	esm: --experimental-default-type flag to flip module defaults	2023-09-29 06:18:44 +00:00
path.md	doc: add lint rule to enforce trailing commas	2022-11-17 13:19:12 +00:00
perf_hooks.md	doc: indicate that name is no longer an optional argument	2023-03-17 12:48:53 +00:00
permissions.md	doc: document dangerous symlink behavior	2023-09-29 11:31:51 +00:00
policy.md	doc: add missing period	2023-08-10 15:37:10 +00:00
process.md	2023-09-18, Version 20.7.0 (Current)	2023-09-18 17:36:24 +00:00
punycode.md	doc: format doc/api/*.md with markdown formatter	2021-10-20 11:59:11 +02:00
querystring.md	doc: remove Legacy status from querystring	2022-10-09 15:22:50 +00:00
readline.md	doc: detailed description of keystrokes Ctrl-Y and Meta-Y	2023-08-08 19:51:43 +00:00
repl.md	doc: harmonize fenced code snippet flags	2023-05-21 09:36:57 +02:00
report.md	doc: use "file system" instead of "filesystem"	2023-01-14 01:10:38 +00:00
single-executable-applications.md	2023-09-04, Version 20.6.0 (Current)	2023-09-04 15:01:52 -05:00
stream.md	2023-09-18, Version 18.18.0 'Hydrogen' (LTS)	2023-09-18 17:39:17 -04:00
string_decoder.md	doc: add print results for examples in StringDecoder	2023-08-27 15:32:47 +00:00
synopsis.md	doc: harmonize fenced code snippet flags	2023-05-21 09:36:57 +02:00
test.md	test_runner: accept testOnly in run	2023-09-24 10:46:13 +00:00
timers.md	2023-09-18, Version 18.18.0 'Hydrogen' (LTS)	2023-09-18 17:39:17 -04:00
tls.md	2023-07-05, Version 20.4.0 (Current)	2023-07-05 10:51:42 -03:00
tracing.md	src: trace threadpool event	2022-11-01 04:21:13 +00:00
tty.md	doc: clarify tty.isRaw	2023-05-21 16:41:28 +00:00
url.md	doc: fix history comments	2023-09-20 12:40:54 +00:00
util.md	2023-09-28, Version 20.8.0 (Current)	2023-09-28 23:14:36 -04:00
v8.md	doc,test: update the v8.startupSnapshot doc and test the example	2023-05-03 13:14:56 +00:00
vm.md	doc,vm: clarify usage of cachedData in vm.compileFunction()	2023-05-29 01:26:22 +00:00
wasi.md	doc: harmonize fenced code snippet flags	2023-05-21 09:36:57 +02:00
webcrypto.md	crypto: remove webcrypto EdDSA key checks and properties	2023-09-01 12:00:16 +00:00
webstreams.md	doc: promote fetch/webstreams from experimental to stable	2023-09-24 23:10:51 +02:00
worker_threads.md	doc: clarify use of process.env in worker threads on Windows	2023-08-05 15:26:19 +00:00
zlib.md	doc: add lint rule to enforce trailing commas	2022-11-17 13:19:12 +00:00