alpha nerd
00388ccb01
All checks were successful
NYX Security Scan / nyx-scan (pull_request) Successful in 5m49s
Memory protection (step 3 of the Python parity work):
NodeSecureMemory has implemented lockMemory/unlockMemory since the
native addon landed, but nothing ever called them — mlock was dead code
while getProtectionInfo() reported method: 'mlock' and canLock: true.
The library claimed a protection it was not applying.
- SecureByteContext now locks on entry and unlocks on exit, mirroring
Python's secure_bytearray(lock=True). Zeroing happens *before*
unlocking, so cleartext cannot reach swap in between.
- lockMemory/unlockMemory are part of the SecureMemory interface, so
the browser implementation must answer for them explicitly (false).
- Locking is best-effort throughout: a refused or throwing lock
degrades to zeroing only, which still has value.
getProtectionInfo() now probes rather than assumes. Having the addon
loaded is not the same as being allowed to lock: mlock is routinely
refused by RLIMIT_MEMLOCK, which is small by default and 0 in some
containers. canLock reflects a real mlock attempt, and 'mlock' is only
claimed when locking genuinely works — otherwise it reports zero-only
and says why. ProtectionInfo also carries platform, hasSecureZeroing
and pageSize, closer to Python's get_protection_info().
SAST (ts.code_exec.new_function, ERROR):
JwtQuoteVerifier loaded ESM-only jose via new Function('s', 'return
import(s)'). No user input reached it, so it was not code injection —
but new Function is blocked by any CSP without 'unsafe-eval', and this
package ships a browser bundle, so the failure would land in the
attestation path. Removed in favour of injection: pass the module as
options.jose when require('jose') cannot work. The error message says
so. No eval-equivalent remains in src/.
.nyx/triage.json records the two native/src/mlock.cc cfg-resource-leak
warnings as false positives, scoped to that file rather than the rule,
so a genuine leak in future C++ still surfaces.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| unit | ||
| build.txt | ||