Skip to content

Commit 85e6c7b

Browse files
mcollinamcollina
committed
doc: clarify build environment is trusted in threat model
Add build system attacks (command injection via environment variables, path hijacking, file permissions) to the list of non-vulnerabilities. The build environment is a trusted element and these scenarios require an already-compromised system.
1 parent 286828b commit 85e6c7b

1 file changed

Lines changed: 15 additions & 0 deletions

File tree

‎SECURITY.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,21 @@ the community they pose.
335335
proper security boundaries between trusted application logic and untrusted
336336
user input.
337337

338+
#### Build System Attacks Requiring Control of the Build Environment (CWE-78, CWE-114, CWE-276)
339+
340+
* The Node.js build system (e.g., `configure`, `configure.py`, `Makefile`,
341+
`vcbuild.bat`) is designed to run in a trusted build environment.
342+
The build environment, including environment variables, the file system,
343+
and locally installed tools, is a trusted element in the Node.js threat model.
344+
* Reports about command injection via environment variables in build scripts
345+
(e.g., `CC`, `CXX`, `PKG_CONFIG`, `RUSTC`), path hijacking in build output
346+
directories, or file permissions of build artifacts are **not** considered
347+
vulnerabilities. These scenarios require the attacker to already have control
348+
over the build environment, which means the system is already compromised.
349+
* Build scripts are not a security boundary. They are expected to execute
350+
tools and scripts specified by the environment, and to trust the
351+
file system they operate on.
352+
338353
#### Unhandled 'error' Events on EventEmitters (CWE-248)
339354

340355
* EventEmitters that can emit `'error'` events require the application to

0 commit comments

Comments
 (0)