GitHub - HoLyVieR/prototype-pollution-nsec18: Content released at NorthSec 2018 for my talk on prototype pollutionYou signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.
CVE-2018-7160 - Pwning (NodeJS) Developers
TL;DR:Â Â NodeJS in debug mode did not check the Origin-Header of websocket connections. This could lead to arbitrary code execution on victims systems if they visited a malicious website while debugging NodeJS. Visual Studio Code 1.19 - 1.19.2 was running in debug mode by default and exposed all users to this vulnerability. Due to my suspiciousness against 3rd party software (probably a side effect
Node.js Performance 改善ガイド - from scratch
Node.js Performance 改善ガイド Memory ã®å ´åˆ メモリリークã‹ã©ã†ã‹ã‚’特定ã™ã‚‹ メモリリークã§ã¯ãªã„å ´åˆ CPU ã®å ´åˆ ã©ã“ã®å‡¦ç†ã«æ™‚é–“ãŒã‹ã‹ã£ã¦ã„ã‚‹ã®ã‹ã‚’確èªã™ã‚‹ v8 simple profiler flame graph ã‚’å–å¾—ã™ã‚‹ File ã®å ´åˆ 大ããªã‚µã‚¤ã‚ºã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ã©ã†ã—ã¦ã‚‚扱ã†æ™‚ Network ã®å ´åˆ keepalive ã‚’ on ã«ã™ã‚‹ ãã®ä»–: 全体的ã«ãƒ‘フォーマンスを改善ã™ã‚‹ãŸã‚ã«ã‚„ã‚‹ã“㨠JIT ãŒåŠ¹ã„ã¦ã„ã‚‹ã‹ã‚’確èªã™ã‚‹ clusterãŒä½¿ãˆãªã„ã‹æ¤œè¨Žã™ã‚‹ C++ addons vs JavaScript libraries ã¾ã¨ã‚ å‚考資料 Node.js Performance 改善ガイド ã“ã®è¨˜äº‹ã¯ Node.js 2 Advent Calender ã® 5日目ã®è¨˜äº‹ã§ã™ã€‚ qiita.com Node.js ã®ãƒ‘フォーマンスã«
[Node.js] ç„¡æ–™ã§ç°¡å˜ã«ã‚¦ã‚§ãƒ–アプリを公開ã§ãるサービス「Glitchã€ã‚’使ã£ã¦ã¿ãŸï¼ - Qiita
Glitchã¨ã¯ Glitchã¯Node.jsã®ã‚¢ãƒ—リを公開ã™ã‚‹ãŸã‚ã®ã‚µãƒ¼ãƒ“スã§ã™ã€‚ Node.jsã§ã‚¦ã‚§ãƒ–アプリを公開ã—よã†ã¨ã™ã‚‹ã¨ã€ã‚µãƒ¼ãƒãƒ¼ã®è¨å®šã—ãŸã‚Šãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’å–å¾—ã—ãŸã‚Šâ€¦ã¨ã¦ã‚‚複雑ã§ã™ã€‚ Glitchã¯ã€ã‚ãªãŸã®å‰µé€ 性を試ã™ã“ã¨ã ã‘ã«é›†ä¸ã§ãã¾ã™ã€‚ Glitchã¯ã€ã‚ã®æœ‰åãªãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆç®¡ç†ãƒ„ールã®Trelloã‚’ã¤ãã£ãŸFogCreekSoftware社ã«ã‚ˆã£ã¦é–‹ç™ºãŒé€²ã‚られã¦ã„ã¾ã™ï¼ アプリを公開ã™ã‚‹ãŸã‚ã ã‘ã§ãªãã€ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã®Editorãªã©ã‚‚ã¤ã„ã¦ã„ã„æ„Ÿã˜ã§ã™ã€‚ 使ã£ã¦ã¿ã‚‹ ã“ã‚Œã¾ã§AWSã‚„ã•ãらインターãƒãƒƒãƒˆãªã©ã‚’使ã£ã¦ã„ã¾ã—ãŸãŒã€Glitchã¯ãšã°æŠœã‘ã¦ç°¡å˜ã§ã™ã€‚ ã¾ãšã¯Glitchã«ã‚¢ã‚¯ã‚»ã‚¹ã—ã¾ã™ã€‚ æ–°ã—ã„プãƒã‚¸ã‚§ã‚¯ãƒˆã®ä½œæˆ1 å³ä¸Šã®â‘ [Sign in]ボタンã‹ã‚‰ãƒã‚°ã‚¤ãƒ³ã—ã¾ã™ã€‚ Facebookã‹GitHubãŒé¸ã¹ã¾ã™ãŒã€å¾Œã€…GitHubã‹ã‚‰ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰ã‚’å–å¾—ã™ã‚‹ã“ã¨
![[Node.js] ç„¡æ–™ã§ç°¡å˜ã«ã‚¦ã‚§ãƒ–アプリを公開ã§ãるサービス「Glitchã€ã‚’使ã£ã¦ã¿ãŸï¼ - Qiita](https://cdn-ak-scissors.b.st-hatena.com/image/square/eabad27b24c49104759a8c22d9e0641de57f6bef/height=288;version=1;width=512/https%3A%2F%2Fqiita-user-contents.imgix.net%2Fhttps%253A%252F%252Fqiita-user-contents.imgix.net%252Fhttps%25253A%25252F%25252Fcdn.qiita.com%25252Fassets%25252Fpublic%25252Farticle-ogp-background-afbab5eb44e0b055cce1258705637a91.png%253Fixlib%253Drb-4.0.0%2526w%253D1200%2526blend64%253DaHR0cHM6Ly9xaWl0YS11c2VyLXByb2ZpbGUtaW1hZ2VzLmltZ2l4Lm5ldC9odHRwcyUzQSUyRiUyRnFpaXRhLWltYWdlLXN0b3JlLnMzLmFwLW5vcnRoZWFzdC0xLmFtYXpvbmF3cy5jb20lMkYwJTJGMTM0MDc2JTJGcHJvZmlsZS1pbWFnZXMlMkYxNjQ2NzA5NTAwP2l4bGliPXJiLTQuMC4wJmFyPTElM0ExJmZpdD1jcm9wJm1hc2s9ZWxsaXBzZSZmbT1wbmczMiZzPThkOTRlZWZkMGQ0NDk2ZTY5MjY0ZGNlYjk5NTM2N2Fl%2526blend-x%253D120%2526blend-y%253D467%2526blend-w%253D82%2526blend-h%253D82%2526blend-mode%253Dnormal%2526s%253D51841677f65148d83b3a14a242bd2b20%3Fixlib%3Drb-4.0.0%26w%3D1200%26fm%3Djpg%26mark64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTk2MCZoPTMyNCZ0eHQ9JTVCTm9kZS5qcyU1RCUyMCVFNyU4NCVBMSVFNiU5NiU5OSVFMyU4MSVBNyVFNyVCMCVBMSVFNSU4RCU5OCVFMyU4MSVBQiVFMyU4MiVBNiVFMyU4MiVBNyVFMyU4MyU5NiVFMyU4MiVBMiVFMyU4MyU5NyVFMyU4MyVBQSVFMyU4MiU5MiVFNSU4NSVBQyVFOSU5NiU4QiVFMyU4MSVBNyVFMyU4MSU4RCVFMyU4MiU4QiVFMyU4MiVCNSVFMyU4MyVCQyVFMyU4MyU5MyVFMyU4MiVCOSVFMyU4MCU4Q0dsaXRjaCVFMyU4MCU4RCVFMyU4MiU5MiVFNCVCRCVCRiVFMyU4MSVBMyVFMyU4MSVBNiVFMyU4MSVCRiVFMyU4MSU5RiVFRiVCQyU4MSZ0eHQtYWxpZ249bGVmdCUyQ3RvcCZ0eHQtY29sb3I9JTIzMUUyMTIxJnR4dC1mb250PUhpcmFnaW5vJTIwU2FucyUyMFc2JnR4dC1zaXplPTU2JnR4dC1wYWQ9MCZzPWYwNjZkNmNlNzgxYzg0ODM0ZDAwODMzYjQ0NjQyNGE1%26mark-x%3D120%26mark-y%3D112%26blend64%3DaHR0cHM6Ly9xaWl0YS11c2VyLWNvbnRlbnRzLmltZ2l4Lm5ldC9-dGV4dD9peGxpYj1yYi00LjAuMCZ3PTgzOCZoPTU4JnR4dD0lNDB5b25lZGFjbyZ0eHQtY29sb3I9JTIzMUUyMTIxJnR4dC1mb250PUhpcmFnaW5vJTIwU2FucyUyMFc2JnR4dC1zaXplPTM2JnR4dC1wYWQ9MCZzPTg1MThiMzQ5YzgxMjI5NDJkNGE4MjliNTIxMDU3Nzhi%26blend-x%3D242%26blend-y%3D480%26blend-w%3D838%26blend-h%3D46%26blend-fit%3Dcrop%26blend-crop%3Dleft%252Cbottom%26blend-mode%3Dnormal%26s%3D947f1d42d364d746603063057ca0ef09)
Node.jsã®ãƒ‘フォーマンスãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚°ã®tips - 技術探ã—
--inspect, --inspect-brk --trace-opt, --trace-deopt --prof --trace-events-enabled --trace-gc node-report Performance Timing API 優ã—ã„コードã®æ›¸ã方㸠v8::SnapshotCreator ã•ã„ã”ã« Node9ãŒ10/31ã«å‡ºã¾ã—ãŸðŸŽ‰ðŸŽ‰ðŸŽ‰ Node v9.0.0 (Current) | Node.js 今回ã¯Nodeå˜ä½“ã®è©±ãªã®ã§ã€Expressã€Nginxç‰ã®ãƒãƒ¥ãƒ¼ãƒ‹ãƒ³ã‚°ã«é–¢ã—ã¦ã¯ã‚³ã‚³ã«ã¯æ›¸ãã¾ã›ã‚“。 ã¾ãŸã€libuvç‰ã®ã‚³ãƒ¼ãƒ‰å†…部ã®è©±ã‚‚ã—ã¾ã›ã‚“。 --inspect, --inspect-brk ã‚‚ã¨ã‚‚ã¨ã‚ã£ãŸã€--debugã‹ã‚‰ç§»è¡Œã•ã‚Œã¾ã—ãŸã€‚(v8.0.0 ~) Chromeを使ã„デãƒãƒƒã‚°ã€ãƒ—ãƒãƒ•ã‚¡ã‚¤ãƒªãƒ³ã‚°ç‰ã‚’使ãˆã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ ブラウザã§ä½¿ãˆ
node ã® security checkã‚’ã™ã‚‹ãªã‚‰ nsp ãŒä¾¿åˆ© - from scratch
nspã¨ã¯ 先日ãŸã¾ãŸã¾ä¼šç¤¾ã§ Vulnerability ã®è©±ã«ãªã£ã¦è‰²ã€…㨠Node.js ã ã¨ã“ã†ã„ã†ã®ã‚ã‚‹ã‚“ã§ã™ã‚ˆã£ã¦è¨€ã£ãŸã‚‰çŸ¥ã‚‰ãªã‹ã£ãŸæ–¹ã‚‚多ã‹ã£ãŸã®ã§ç´¹ä»‹ã€‚ nsp 㯠node security platform ã®é æ–‡å—ã‚’å–ã£ãŸãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§ã‚る。 Node Security Platform ã¯ã‚µã‚¤ãƒˆä¸Šã§è„†å¼±æ€§ã‚’公開ã—ã¦ã„る。 Node.js ã®ã‚³ã‚¢ã®è„†å¼±æ€§ã¨ã„ã†ã‚ˆã‚Šã‚‚ npm モジュールãªã©ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã®è„†å¼±æ€§ã 。 nsp ã«æŒ™ã’られã¦ã‚‹è„†å¼±æ€§ã®ä¸€ä¾‹ 例ãˆã°ã“ã®è„†å¼±æ€§ãªã‚“ã‹ã¯2017å¹´2月11æ—¥ã«å…¬é–‹ã•ã‚ŒãŸè„†å¼±æ€§ã§ã‚る。 https://nodesecurity.io/advisories/313 github.com ã©ã†ã„ã†è„†å¼±æ€§ã‹ã¨ã„ã†ã¨ã€ã“ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã¯JavaScript Objectをシリアライズã™ã‚‹ãŸã‚ã®ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã ãŒã€ãã®serializeã™ã‚‹æ™‚ã«é–¢æ•°ã¾
ES Modules 㨠Node.js ã«ã¤ã„㦠- from scratch
書ã“ã†æ›¸ã“ã†ã¨æ€ã„ãªãŒã‚‰ã“ã®ã‚¿ã‚¤ãƒŸãƒ³ã‚°ã¾ã§ã®ãŒã—ã¦ã—ã¾ã„ã¾ã—ãŸã€‚ 今一番 Node.js ã®ä¸ã§ hot 㪠discussion ã®ä¸€ã¤ã¨è¨€ãˆã‚‹ã§ã—ょã†ã€ã€ŽES Modules ㌠Node.js ã®ä¸ã§ã©ã†ãªã‚‹ã‹ã€ã§ã™ã€‚ ES Modules ç¾æ³ ES2015 ãŒç™ºåˆŠã•ã‚Œã¦ãã‚ãã‚一年ã§ã™ã€‚ ES2015 ã«ã‚る機能㯠Node.js v6ã§ã‚‚ 93% 程度カãƒãƒ¼ã•ã‚Œã¦ã„ã¾ã™ã€‚モダンブラウザã§ã‚‚大体ãŒ90%を超ãˆã¦ã„ã¾ã™ã€‚ã—ã‹ã—〠ES Modules ã ã‘ã¯ã¾ã ã©ã®ãƒ–ラウザも実装ã—ãã‚Œã¦ã„ã¾ã›ã‚“(kangax compat table 㯠ES Modules ã¯çœã‹ã‚Œã¦ã¾ã™)。 ãã‚‚ãã‚‚ ECMAScript 2015 自身ã§å®šç¾©ã•ã‚ŒãŸã®ã¯æ§‹æ–‡ã ã‘ãªã®ã§ã€æ§‹æ–‡ã¯ã¨ã‚‚ã‹ãã€ã©ã†ã‚„ã£ã¦ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã‚’å–ã£ã¦ãã‚‹ã‹ã¨ã„ㆠLoader ã®éƒ¨åˆ†ãŒã¾ã 決ã¾ã‚Šãã£ã¦ã„ã¾ã›ã‚“。 https://w
Node.js v4 ã®è©± #tng18
æ±äº¬Nodeå¦åœ’ 18時é™ç›®ã§ç™ºè¡¨ã—㟠Node.js v4 ã®è©±ã§ã™
1
ランã‚ング
ãŠçŸ¥ã‚‰ã›
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Hacking Node Serialize | Websecurify Blog
{{#tags}}- {{label}}
{{/tags}}