1200345 - JS::ubi::Node comments should mention security concerns

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jim Blandy :jimb]

Attachment: Add comment to js/public/UbiNode.h warning about operating on graphs constructed by hostile code.

Since analyses on the ubi::Node graph are operating on data influenced by content, they must be robust when consuming graphs produced by hostile code. The comments in js/public/UbiNode.h should point this out.

Comment 1

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

Comment on attachment 8654990 [details] [diff] [review]
Add comment to js/public/UbiNode.h warning about operating on graphs constructed by hostile code.

Review of attachment 8654990 [details] [diff] [review]:
-----------------------------------------------------------------

Awesome, thanks!

Comment 2

[Nick Fitzgerald [:fitzgen] [⏰PST; UTC-8]]

+CC sfink, just FYI since you're the other person primarily looking at and reviewing ubi::Node stuff.

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8985a835958c

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/8985a835958c

Comment 5

[Steve Fink [:sfink] [:s:]]

Thanks, I hadn't really thought about that angle. It's a good thing to keep in mind.