search

patriksimek / vm2

Advanced vm/sandbox for Node.js
MIT License
3.86k stars 293 forks source link

Create advisories for past breakouts and security policy for future reports #338

Open cristianstaicu opened 3 years ago

cristianstaicu commented 3 years ago

Hi there,

Since this is a high-profile package on npm and many GitHub repositories rely on it for isolation, I was wondering if disclosure of security issues shouldn't be done in a more organized/principled way? If you agree with me, please create a security policy (https://github.com/patriksimek/vm2/security/policy) with a security email address for the volunteers to report to. Additionally, it would be great to have security advisories (https://github.com/patriksimek/vm2/security/advisories) for past breakouts so that users are informed when they install a vulnerable version. Here is a possibly incomplete list of them:

https://github.com/patriksimek/vm2/issues/76 https://github.com/patriksimek/vm2/issues/187 https://github.com/patriksimek/vm2/issues/197 https://github.com/patriksimek/vm2/issues/224 https://github.com/patriksimek/vm2/issues/225 https://github.com/patriksimek/vm2/issues/268 https://github.com/patriksimek/vm2/issues/276 https://github.com/patriksimek/vm2/issues/285

Best, Cris

cristianstaicu commented 3 years ago

Hi there,

Since setting up a policy and creating CVEs can be easily done from the "Security" tab above, I thought of reminding you about this open issue. It should not take more than 10-15 mins to resolve.

Best, Cris

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

cristianstaicu commented 2 years ago

It's a pity that a critical package for the npm ecosystem treats security this way.

patriksimek commented 2 years ago

Hi Christian, unfortunately, I can't currently put any time into maintaining the package. However, I'm happy to add you or anyone who would be interested in maintaining it.

cristianstaicu commented 2 years ago

Hey Patrik, I would like to help with issuing the advisories, but unfortunately, I do not think I can commit to putting in the necessary development effort required for maintaining this package. As you may have seen, we are trying to report some sandbox breakout vulnerabilities in the latest version (#363 ), and we believe it would require quite some dev effort to fix them. Isn't there a way to ask help from the community for this, e.g., https://huntr.dev/ or https://sos.dev/ ?

cmawhorter commented 2 years ago

oof. i'm so confused. i received a GH alert about a fixed critical vuln., but having trouble finding the code that addresses it.

it seems the two primary devs no longer have time to maintain it -- perhaps it's time to EOL vm2? talk of handing over dev to a new party makes my supply chain spidey sense tingle.

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

jjhbw commented 2 years ago

Bump to ensure this issue isn't closed.

IMO this issue is critical. Recent commits have proven very difficult to 'audit' and the changelog is IMO pretty opaque. This combined with the fact that a new maintainer took over really hurts confidence. Supply chain risk in the ecosystem is very real as we've seen in the last years.

The new maintainer @XmiliaH seems active and I do not want to imply he/she is acting in bad faith. I'm just saying that improving the interpretability of commits for non-maintainers and actually documenting security fixes would go a long way.

I really respect the maintainer's work, and I realise i'm getting the immense work that this library represents for free. Please consider the above advice instead of armchair criticism.