assemblee-virtuelle / assemblee-virtuelle/Semantic-Bus
security in transformer
Open
bug
hight priority
- Dominant language
- JavaScript
- Stars
- 57
- Forks
- 10
- Avg merge
- 8m
- Merged PRs (30d)
- 55
Description
Transformer execute all javascript string including unsafe command on server.
https://odino.org/eval-no-more-understanding-vm-vm2-nodejs/
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing the transformer execution path and the linked article about eval, vm, and vm2 in Node.js. Define how JavaScript strings are executed on the server, then establish tests showing that unsafe commands cannot execute while valid data transformations continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100