Skip to content

policy: add dependencies map for redirect and whitelisting #28767

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
bmeck wants to merge 10 commits into from
Closed

policy: add dependencies map for redirect and whitelisting #28767

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
443b036
policy: add dependencies map for redirect and whitelisting
bmeck Jul 18, 2019
4cecf1c
Update doc/api/policy.md
bmeck Jul 20, 2019
1f1e8d8
add doc note about needing more mitigations
bmeck Jul 22, 2019
ae801f2
add tests and wildcards
bmeck Jul 22, 2019
3514dbc
slightly better docs
bmeck Jul 22, 2019
88c578c
fix ESM integration / tests
bmeck Jul 23, 2019
5774f78
lint nits
bmeck Jul 23, 2019
8a2e4a5
doc wording
bmeck Jul 24, 2019
282ed3f
doc wording
bmeck Jul 24, 2019
7452bb6
doc wording
bmeck Jul 24, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
doc wording
  • Loading branch information
@bmeck
bmeck committed Jul 24, 2019
commit 8a2e4a535afcf89af7783a93bf8b941bfc6c6a20
19 changes: 11 additions & 8 deletions doc/api/policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,9 +116,10 @@ resources to be considered valid.

### Dependency Redirection

An application may need to ship patched versions of software or to prevent
software from allowing all modules access to all other modules. In order to
do so redirection can be used.
An application may need to ship patched versions of modules or to prevent
modules from allowing all modules access to all other modules. In order to
do so redirection can be used by intercepting attempts to load the modules
wishing to be replaced.

```json
{
Expand Down Expand Up @@ -148,12 +149,14 @@ be used to find the module.
If the value of the redirection is a string, it will be resolved relative to
the manifest and then immediately be used without searching.

Any specifier missing from the list of dependency will result in an error
according to the policy.
Any specifier string that is `require()`ed and not listed in the dependencies
will result in an error according to the policy.

This will not prevent access to APIs through other means such as direct access
to `require.cache` and/or through `module.constructor`. Other means such as
attenuating variables are necessary to lock down that path of loading modules.
Redirection will not prevent access to APIs through means such as direct access
to `require.cache` and/or through `module.constructor` which allow access to
loading modules. Policy redirection only affect specifiers to `require()`.
Other means such as to prevent undesired access to APIs through variables are
necessary to lock down that path of loading modules.

A boolean value of `true` for the dependencies map can be specified to allow a
module to load any specifier without redirection. This can be useful for local
Expand Down