A Sense of Time for JavaScript and Node.js
summary
Defines Event Handler Poisoning (EHP) as a denial-of-service that blocks the event loop or small worker pool, mines a 1,132-vuln NPM dataset and finds ~35% exploitable (266 arbitrary-file IO, 115 ReDoS), and implements first-class timeouts by modifying V8, libuv, and adding manager threads to deliver timeout exceptions. Prototype Node.cure is ~4,000 LOC touching 50 files, passes core tests, is open-sourced, and reports runtime overheads from 0% to 24% on real apps.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:29Contributions
- 1:06Node.js: A JS framework for web services
- 1:59One Thread per Client Architecture (OTPCA)
- 2:36Event-Driven Architecture (EDA)
- 4:32Server architecture dictates programming style
- 5:48The EDA gains efficiency, loses isolation
- 6:25Behavior during EHP attack on the Event Loop
- 7:20Vulnerable server
- 8:45ReDoS-based EHP attack
- 9:2735% of NPM vulnerabilities enable EHP
- 10:22Naive 1: Restart the server
- 10:55Naive 2: Prevent through partitioning
- 11:54Partitioning is partial and ad hoc
- 14:18Desired behavior
- 14:33Adding first-class timeouts to Node.js
- 15:43Node.cure prototype
- 16:01Security guarantees
- 17:08Performance penalty
- 17:56Changes to Node.js core
related talks
32mWriting Secure JavaScript Code
42mThe Node.js Highway: Attacks Are At Full Throttle
30mDo Not Thrash the Node.js Event Loop
55mNode.js Security: Breaking The Loop
47mNode.js Security: Breaking The Loop
22mHODOR: Reducing Attack Surface on Node.js via System Call Limitation
30mNode.js Feature Livecoding
29mA Node.js Security Roadmap