Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
snabbdom-signature
Advanced tools
Readme
Protects your app against vnode injection.
const text = userInput.potentiallyMaliciousInput;
// Thanks to Snabbdom-Signature this is XSS-free.
const vnode = h('p', text);
Snabbdom vnodes are just data structures. It's impossible to distinguish vnodes created by the programmer from user-supplied objects. Malicious vnodes may come from sources like web requests or document-oriented databases. It is a type of XSS attacks.
Snabbdom-Signature ships with two essential parts.
h
vnode factory function which marks the vnodes it creates with a Symbol.const h = snabbdomSignature.signingH(require('snabbdom/h').default);
const vnode = h('p', text); // {sel: "p", data: {snabbdom_signature: Symbol(snabbdom_signature)}, /* ... */ }
Please bear in mind that in order for this mechanism to work, the browser must support Symbols.
const patch = snabbdom.init([
snabbdomSignature.denyUnlessSigned,
// other modules
]);
Since now the patch
function throws an error (Error: Patching with a vnode which is not correctly signed!
) when it encounters an unsigned vnode.
First, install the package.
npm i snabbdom-signature
Then, add the denyUnlessSigned
module to your snabbdom init call and get the vnode signing version of the h
function.
const snabbdom = require('snabbdom');
// Include the Snabbdom-Signature package
const snabbdomSignature = require('snabbdom-signature');
const patch = snabbdom.init([
// Add the snabbdomSignature.denyUnlessSigned module
// to make sure that every vnode has been created by the programmer
// and not a malicious user.
snabbdomSignature.denyUnlessSigned,
// other modules
]);
// This helper function signs vnodes.
// Use it like you use the default h helper.
const h = snabbdomSignature.signingH(require('snabbdom/h').default);
Let's say signedVnode
is a complex tree with many signed vnodes.
In order to be able to do things like sending vnodes to another window, we need to remove all the signatures, because Symbols don't survive structured cloning.
const snabbdomSignature = require('snabbdom-signature');
const removeSignature = snabbdomSignature.removeSignature;
// This form is ready for serialization/structured cloning.
const unsigned = removeSignature(signedVnode);
Because signature validation usually happens during the patching phase, there's a chance that the tree we pass to the removeSignature
function consists of an injected, malicious vnode. That's why the removeSignature function verifies the signature and throws an error if it's invalid. You can be sure that if the signature is removed successfully, you can trust this tree again.
In the previous step we built a potentially dangerous tree of vnodes. Then, we used the removeSignature
function to remove automatically added signatures (after verifying if all nodes were correctly signed).
Let's say that unsigned
is that signature-less tree received from a trusted source. In order to be able to use it, we need to add all the signatures again.
const snabbdomSignature = require('snabbdom-signature');
const sign = snabbdomSignature.sign;
// This form is accepted by the patch function.
const signedAgain = sign(unsigned);
Please, make sure that you're not calling trust
on trees coming from untrusted sources, like user-supplied JSON etc. Otherwise, there's a risk of XSS. Also, make sure that the unsigned node you're trusting has been somehow verified earlier, either by the removeSignature
function or by successfully patch
ing the DOM with it.
If you found a security vulnerability in this package, please write to me at kontakt@lukaszmakuch.pl.
If you know a way to improve the performance or fix a bug which is not related to security, feel free to create an issue or submit a pull request.
FAQs
Protects against vnode injection.
The npm package snabbdom-signature receives a total of 54 weekly downloads. As such, snabbdom-signature popularity was classified as not popular.
We found that snabbdom-signature demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.