Node.js application (in)security
summary
Claims concrete failures and fixes: server-side eval → remote JS execution is present in real GitHub examples and allows arbitrary code; use child_process spawn/execFile instead of exec to avoid command injection; file-server patterns expose directory traversal and must validate paths; npm modules and Express middleware are practical mitigations; crypto.randomBytes versus pseudoRandomBytes confusion leads to weak CSRF tokens unless entropy is pre-seeded; console.log can inject terminal escape attacks; uninitialized memory in Buffers leaks heap contents so allocate/zero memory before use.
AI-written summary · about
chapters (41)
- 0:00Intro
- 1:00Agenda
- 1:41Not chance
- 2:11Target audience
- 3:07What is NoDot
- 4:21Why NoDot
- 7:13Frameworks
- 8:00Categories
- 8:15Crosssite scripting
- 9:40escaping code
- 10:30escape modules
- 11:28secret section
- 12:23user input
- 13:05query language
- 13:50use prepared statements
- 15:14portrait protection
- 17:48false opening
- 19:15headers
- 19:51classic
- 20:06eval
- 22:37exit method
- 24:14GitHub example
- 24:43Tips
- 26:02Record diversity
- 26:48Not my test
- 28:26Random numbers
- 29:09Random bytes
- 29:23Pseudorandom
- 29:53Rocket
- 30:10Stupid Dancer
- 30:23Im tutoring area
- 30:41Openness
- 31:32The problem
- 35:49Honey success
- 37:31Buffer class
- 39:31Buffer
- 40:38ReadWrite
- 42:36Buffer Overflow
- 42:58Watch out allocations
- 43:43Summary
- 44:33Conclusion
