Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

child_process: validate arguments for null bytes #44782

Conversation

RaisinTen
Copy link
Contributor

@RaisinTen RaisinTen commented Sep 25, 2022

This change adds validation to reject an edge case where the child_process API argument strings might contain null bytes somewhere in between. Such strings were being silently truncated before, so throwing an error should prevent misuses of this API.

Fixes: #44768
Signed-off-by: Darshan Sen raisinten@gmail.com

@nodejs-github-bot nodejs-github-bot added child_process Issues and PRs related to the child_process subsystem. needs-ci PRs that need a full CI run. labels Sep 25, 2022
@nodejs-github-bot

This comment was marked as outdated.

@RaisinTen RaisinTen force-pushed the child_process/validate-arguments-for-null-bytes branch from c74b77f to 67903b0 Compare September 25, 2022 10:38
@nodejs-github-bot

This comment was marked as outdated.

lib/child_process.js Outdated Show resolved Hide resolved
lib/child_process.js Outdated Show resolved Hide resolved
This change adds validation to reject an edge case where the
child_process API argument strings might contain null bytes
somewhere in between. Such strings were being silently truncated
before, so throwing an error should prevent misuses of this API.

Fixes: nodejs#44768
Signed-off-by: Darshan Sen <raisinten@gmail.com>
@RaisinTen RaisinTen force-pushed the child_process/validate-arguments-for-null-bytes branch from 67903b0 to a6bb1c4 Compare October 3, 2022 13:46
@RaisinTen RaisinTen added the request-ci Add this label to start a Jenkins CI on a PR. label Oct 3, 2022
@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Oct 3, 2022
@nodejs-github-bot

This comment was marked as outdated.

@RaisinTen
Copy link
Contributor Author

cc @nodejs/child_process in case anyone else also wants to take a look.

Copy link
Member

@ZYSzys ZYSzys left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be semver-major ?

@RaisinTen
Copy link
Contributor Author

@ZYSzys I would say no because code that previously tried to pass string arguments with null bytes was already broken because the strings were silently getting truncated at the first null byte. This validation would make it easier for users to know where things went wrong.

@RaisinTen RaisinTen added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. and removed review wanted PRs that need reviews. labels Oct 11, 2022
@nodejs-github-bot

This comment was marked as outdated.

@nodejs-github-bot
Copy link
Collaborator

@RaisinTen
Copy link
Contributor Author

@bnoordhuis @ZYSzys would y'all like to take another look?

@RaisinTen RaisinTen added the commit-queue Add this label to land a pull request using GitHub Actions. label Oct 14, 2022
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Oct 14, 2022
@nodejs-github-bot nodejs-github-bot merged commit 91dbd8b into nodejs:main Oct 14, 2022
@nodejs-github-bot
Copy link
Collaborator

Landed in 91dbd8b

@RaisinTen RaisinTen deleted the child_process/validate-arguments-for-null-bytes branch October 14, 2022 13:04
RafaelGSS pushed a commit that referenced this pull request Nov 1, 2022
This change adds validation to reject an edge case where the
child_process API argument strings might contain null bytes
somewhere in between. Such strings were being silently truncated
before, so throwing an error should prevent misuses of this API.

Fixes: #44768
Signed-off-by: Darshan Sen <raisinten@gmail.com>
PR-URL: #44782
Reviewed-By: James M Snell <jasnell@gmail.com>
@RafaelGSS RafaelGSS mentioned this pull request Nov 1, 2022
RafaelGSS pushed a commit that referenced this pull request Nov 10, 2022
This change adds validation to reject an edge case where the
child_process API argument strings might contain null bytes
somewhere in between. Such strings were being silently truncated
before, so throwing an error should prevent misuses of this API.

Fixes: #44768
Signed-off-by: Darshan Sen <raisinten@gmail.com>
PR-URL: #44782
Reviewed-By: James M Snell <jasnell@gmail.com>
danielleadams pushed a commit that referenced this pull request Dec 30, 2022
This change adds validation to reject an edge case where the
child_process API argument strings might contain null bytes
somewhere in between. Such strings were being silently truncated
before, so throwing an error should prevent misuses of this API.

Fixes: #44768
Signed-off-by: Darshan Sen <raisinten@gmail.com>
PR-URL: #44782
Reviewed-By: James M Snell <jasnell@gmail.com>
danielleadams pushed a commit that referenced this pull request Dec 30, 2022
This change adds validation to reject an edge case where the
child_process API argument strings might contain null bytes
somewhere in between. Such strings were being silently truncated
before, so throwing an error should prevent misuses of this API.

Fixes: #44768
Signed-off-by: Darshan Sen <raisinten@gmail.com>
PR-URL: #44782
Reviewed-By: James M Snell <jasnell@gmail.com>
danielleadams pushed a commit that referenced this pull request Jan 3, 2023
This change adds validation to reject an edge case where the
child_process API argument strings might contain null bytes
somewhere in between. Such strings were being silently truncated
before, so throwing an error should prevent misuses of this API.

Fixes: #44768
Signed-off-by: Darshan Sen <raisinten@gmail.com>
PR-URL: #44782
Reviewed-By: James M Snell <jasnell@gmail.com>
codebytere added a commit to electron/electron that referenced this pull request Jan 9, 2023
codebytere added a commit to electron/electron that referenced this pull request Jan 11, 2023
* chore: bump node in DEPS to v18.13.0

* child_process: validate arguments for null bytes

nodejs/node#44782

* bootstrap: merge main thread and worker thread initializations

nodejs/node#44869

* module: ensure relative requires work from deleted directories

nodejs/node#42384

* src: add support for externally shared js builtins

nodejs/node#44000

* lib: disambiguate `native module` to `binding`

nodejs/node#45673

* test: convert test-debugger-pid to async/await

nodejs/node#45179

* deps: upgrade to libuv 1.44.2

nodejs/node#42340

* src: fix cppgc incompatibility in v8

nodejs/node#43521

* src: use qualified `std::move` call in node_http2

nodejs/node#45555

* build: fix env.h for cpp20

nodejs/node#45516

* test: remove experimental-wasm-threads flag

nodejs/node#45074

* src: iwyu in cleanup_queue.cc

nodejs/node#44983

* src: add missing include for `std::all_of`

nodejs/node#45541

* deps: update ICU to 72.1

nodejs/node#45068

* chore: fixup patch indices

* chore: remove errant semicolons

- nodejs/node#44179
- nodejs/node#44193

* src: add support for externally shared js builtins

nodejs/node#44376

* chore: add missing GN filenames

* deps: update nghttp2 to 1.51.0

nodejs/node#45537

* chore: disable more Node.js snapshot tests

The Snapshot feature is currently disabled

* chore: disable ICU timezone tests

Node.js uses a different version of ICU than Electron so they
will often be out of sync.

* chore: disable threadpool event tracing test

Event tracing is not enabled in embedded Node.js

* chore: fixup patch indices

* chore: comments from review

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
khalwa pushed a commit to solarwindscloud/electron that referenced this pull request Feb 22, 2023
* chore: bump node in DEPS to v18.13.0

* child_process: validate arguments for null bytes

nodejs/node#44782

* bootstrap: merge main thread and worker thread initializations

nodejs/node#44869

* module: ensure relative requires work from deleted directories

nodejs/node#42384

* src: add support for externally shared js builtins

nodejs/node#44000

* lib: disambiguate `native module` to `binding`

nodejs/node#45673

* test: convert test-debugger-pid to async/await

nodejs/node#45179

* deps: upgrade to libuv 1.44.2

nodejs/node#42340

* src: fix cppgc incompatibility in v8

nodejs/node#43521

* src: use qualified `std::move` call in node_http2

nodejs/node#45555

* build: fix env.h for cpp20

nodejs/node#45516

* test: remove experimental-wasm-threads flag

nodejs/node#45074

* src: iwyu in cleanup_queue.cc

nodejs/node#44983

* src: add missing include for `std::all_of`

nodejs/node#45541

* deps: update ICU to 72.1

nodejs/node#45068

* chore: fixup patch indices

* chore: remove errant semicolons

- nodejs/node#44179
- nodejs/node#44193

* src: add support for externally shared js builtins

nodejs/node#44376

* chore: add missing GN filenames

* deps: update nghttp2 to 1.51.0

nodejs/node#45537

* chore: disable more Node.js snapshot tests

The Snapshot feature is currently disabled

* chore: disable ICU timezone tests

Node.js uses a different version of ICU than Electron so they
will often be out of sync.

* chore: disable threadpool event tracing test

Event tracing is not enabled in embedded Node.js

* chore: fixup patch indices

* chore: comments from review

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
gecko19 pushed a commit to brightsign/electron that referenced this pull request Feb 28, 2023
* chore: bump node in DEPS to v18.13.0

* child_process: validate arguments for null bytes

nodejs/node#44782

* bootstrap: merge main thread and worker thread initializations

nodejs/node#44869

* module: ensure relative requires work from deleted directories

nodejs/node#42384

* src: add support for externally shared js builtins

nodejs/node#44000

* lib: disambiguate `native module` to `binding`

nodejs/node#45673

* test: convert test-debugger-pid to async/await

nodejs/node#45179

* deps: upgrade to libuv 1.44.2

nodejs/node#42340

* src: fix cppgc incompatibility in v8

nodejs/node#43521

* src: use qualified `std::move` call in node_http2

nodejs/node#45555

* build: fix env.h for cpp20

nodejs/node#45516

* test: remove experimental-wasm-threads flag

nodejs/node#45074

* src: iwyu in cleanup_queue.cc

nodejs/node#44983

* src: add missing include for `std::all_of`

nodejs/node#45541

* deps: update ICU to 72.1

nodejs/node#45068

* chore: fixup patch indices

* chore: remove errant semicolons

- nodejs/node#44179
- nodejs/node#44193

* src: add support for externally shared js builtins

nodejs/node#44376

* chore: add missing GN filenames

* deps: update nghttp2 to 1.51.0

nodejs/node#45537

* chore: disable more Node.js snapshot tests

The Snapshot feature is currently disabled

* chore: disable ICU timezone tests

Node.js uses a different version of ICU than Electron so they
will often be out of sync.

* chore: disable threadpool event tracing test

Event tracing is not enabled in embedded Node.js

* chore: fixup patch indices

* chore: comments from review

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
gecko19 pushed a commit to brightsign/electron that referenced this pull request Mar 15, 2023
* chore: bump node in DEPS to v18.13.0

* child_process: validate arguments for null bytes

nodejs/node#44782

* bootstrap: merge main thread and worker thread initializations

nodejs/node#44869

* module: ensure relative requires work from deleted directories

nodejs/node#42384

* src: add support for externally shared js builtins

nodejs/node#44000

* lib: disambiguate `native module` to `binding`

nodejs/node#45673

* test: convert test-debugger-pid to async/await

nodejs/node#45179

* deps: upgrade to libuv 1.44.2

nodejs/node#42340

* src: fix cppgc incompatibility in v8

nodejs/node#43521

* src: use qualified `std::move` call in node_http2

nodejs/node#45555

* build: fix env.h for cpp20

nodejs/node#45516

* test: remove experimental-wasm-threads flag

nodejs/node#45074

* src: iwyu in cleanup_queue.cc

nodejs/node#44983

* src: add missing include for `std::all_of`

nodejs/node#45541

* deps: update ICU to 72.1

nodejs/node#45068

* chore: fixup patch indices

* chore: remove errant semicolons

- nodejs/node#44179
- nodejs/node#44193

* src: add support for externally shared js builtins

nodejs/node#44376

* chore: add missing GN filenames

* deps: update nghttp2 to 1.51.0

nodejs/node#45537

* chore: disable more Node.js snapshot tests

The Snapshot feature is currently disabled

* chore: disable ICU timezone tests

Node.js uses a different version of ICU than Electron so they
will often be out of sync.

* chore: disable threadpool event tracing test

Event tracing is not enabled in embedded Node.js

* chore: fixup patch indices

* chore: comments from review

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
gecko19 pushed a commit to brightsign/electron that referenced this pull request Mar 15, 2023
* chore: bump node in DEPS to v18.13.0

* child_process: validate arguments for null bytes

nodejs/node#44782

* bootstrap: merge main thread and worker thread initializations

nodejs/node#44869

* module: ensure relative requires work from deleted directories

nodejs/node#42384

* src: add support for externally shared js builtins

nodejs/node#44000

* lib: disambiguate `native module` to `binding`

nodejs/node#45673

* test: convert test-debugger-pid to async/await

nodejs/node#45179

* deps: upgrade to libuv 1.44.2

nodejs/node#42340

* src: fix cppgc incompatibility in v8

nodejs/node#43521

* src: use qualified `std::move` call in node_http2

nodejs/node#45555

* build: fix env.h for cpp20

nodejs/node#45516

* test: remove experimental-wasm-threads flag

nodejs/node#45074

* src: iwyu in cleanup_queue.cc

nodejs/node#44983

* src: add missing include for `std::all_of`

nodejs/node#45541

* deps: update ICU to 72.1

nodejs/node#45068

* chore: fixup patch indices

* chore: remove errant semicolons

- nodejs/node#44179
- nodejs/node#44193

* src: add support for externally shared js builtins

nodejs/node#44376

* chore: add missing GN filenames

* deps: update nghttp2 to 1.51.0

nodejs/node#45537

* chore: disable more Node.js snapshot tests

The Snapshot feature is currently disabled

* chore: disable ICU timezone tests

Node.js uses a different version of ICU than Electron so they
will often be out of sync.

* chore: disable threadpool event tracing test

Event tracing is not enabled in embedded Node.js

* chore: fixup patch indices

* chore: comments from review

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
@ljharb
Copy link
Member

ljharb commented Jul 22, 2023

This prevents security issues, so it might be nice to backport it to 16. Any chance of that?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
author ready PRs that have at least one approval, no pending requests for changes, and a CI started. child_process Issues and PRs related to the child_process subsystem. needs-ci PRs that need a full CI run.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

child_process.spawn not checking null byte in args
6 participants