diff options
| author | Rich Trott <rtrott@gmail.com> | 2018-10-21 18:53:07 -0700 |
|---|---|---|
| committer | Rich Trott <rtrott@gmail.com> | 2018-10-24 05:57:58 -0700 |
| commit | d214f41afad2c51c8873a01632f962194f0a0c62 (patch) | |
| tree | 78d9c73e4f71f493187dd24a2e97bf2fe26b9711 /README.md | |
| parent | 862b7a1c7be9322c565a40a3e18f06b0e927bda9 (diff) | |
| download | android-node-v8-d214f41afad2c51c8873a01632f962194f0a0c62.tar.gz android-node-v8-d214f41afad2c51c8873a01632f962194f0a0c62.tar.bz2 android-node-v8-d214f41afad2c51c8873a01632f962194f0a0c62.zip | |
doc: remove problematic example from README
Remove Buffer constructor example from security reporting examples. Even
though the example text focuses on API compatibility, the pull request
cited is about zero-filling vs. not zero-filling, which is not an API
compatibility change (or at least is not unambiguously one). The fact
that it's a pull request is also problematic, since it's not reporting a
security issue but instead proposing a way to address one that has
already been reported publicly. Finally, the text focuses on the fact
that it was not deemed worth of backporting, but that was determined by
a vote by a divided CTC. It is unreasonable to ask someone reporting an
issue to make a determination that the CTC/TSC is divided on.
In short, it's not a good example for the list it is in. Remove it.
Refs: https://github.com/nodejs/node/pull/23759#discussion_r226804801
PR-URL: https://github.com/nodejs/node/pull/23817
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 6 |
1 files changed, 0 insertions, 6 deletions
@@ -179,12 +179,6 @@ nonetheless. arbitrary JavaScript code. That is already the highest level of privilege possible. -- [#12141](https://github.com/nodejs/node/pull/12141): _buffer: zero fill - Buffer(num) by default_. The documented `Buffer()` behavior was prone to - [misuse](https://snyk.io/blog/exploiting-buffer/). It has since changed. It - was not deemed serious enough to fix in older releases and breaking API - stability. - ### Private disclosure preferred - [CVE-2016-7099](https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/): |