e34fa2052a
Adds @xuqm/h5-sdk/private entry point with JSON-based initialization, feature gating, and error codes for private deployment scenarios. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
75 行
4.1 KiB
Markdown
75 行
4.1 KiB
Markdown
## Threat Model for resolve (module path resolution library)
|
|
|
|
### 1. Library Overview
|
|
|
|
- **Library Name:** resolve
|
|
- **Brief Description:** Implements Node.js `require.resolve()` algorithm for synchronous and asynchronous file path resolution. Used to locate modules and files in Node.js projects.
|
|
- **Key Public APIs/Functions:** `resolve.sync()` / `resolve/sync`, `resolve()` / `resolve/async`
|
|
|
|
### 2. Define Scope
|
|
|
|
This threat model focuses on the core path resolution algorithm, including filesystem interaction, option handling, and cache management.
|
|
|
|
### 3. Conceptual System Diagram
|
|
|
|
```
|
|
Caller Application → resolve(id, options) → Resolution Algorithm → File System
|
|
│
|
|
└→ Options Handling
|
|
└→ Cache System
|
|
```
|
|
|
|
**Trust Boundaries:**
|
|
- **Input module IDs:** May come from untrusted sources (user input, configuration)
|
|
- **Filesystem access:** The library interacts with the filesystem to resolve paths
|
|
- **Options:** Provided by the caller
|
|
- **Cache:** Used to improve performance, but could be a vector for tampering or information disclosure if not handled securely
|
|
|
|
### 4. Identify Assets
|
|
|
|
- **Integrity of resolution output:** Ensure correct and safe file path matching.
|
|
- **Confidentiality of configuration:** Prevent sensitive path information from being leaked.
|
|
- **Availability/performance for host application:** Prevent crashes or resource exhaustion.
|
|
- **Security of host application:** Prevent path traversal or unintended filesystem access.
|
|
- **Reputation of library:** Maintain trust by avoiding supply chain attacks and vulnerabilities[1][3][4].
|
|
|
|
### 5. Identify Threats
|
|
|
|
| Component / API / Interaction | S | T | R | I | D | E |
|
|
|-----------------------------------------------------|----|----|----|----|----|----|
|
|
| Public API Call (`resolve/async`, `resolve/sync`) | ✓ | ✓ | – | ✓ | – | – |
|
|
| Filesystem Access | – | ✓ | – | ✓ | ✓ | – |
|
|
| Options Handling | ✓ | ✓ | – | ✓ | – | – |
|
|
| Cache System | – | ✓ | – | ✓ | – | – |
|
|
|
|
**Key Threats:**
|
|
- **Spoofing:** Malicious module IDs mimicking legitimate packages, or spoofing configuration options[1].
|
|
- **Tampering:** Caller-provided paths altering resolution order, or cache tampering leading to incorrect results[1][4].
|
|
- **Information Disclosure:** Error messages revealing filesystem structure or sensitive paths[1].
|
|
- **Denial of Service:** Recursive or excessive resolution exhausting filesystem handles or causing application crashes[1].
|
|
- **Path Traversal:** Malicious input allowing access to files outside the intended directory[4].
|
|
|
|
### 6. Mitigation/Countermeasures
|
|
|
|
| Threat Identified | Proposed Mitigation |
|
|
|--------------------------------------------|---------------------|
|
|
| Spoofing (malicious module IDs/config) | Sanitize input IDs; validate against known patterns; restrict `basedir` to app-controlled paths[1][4]. |
|
|
| Tampering (path traversal, cache) | Validate input IDs for directory escapes; secure cache reads/writes; restrict cache to trusted sources[1][4]. |
|
|
| Information Disclosure (error messages) | Generic "not found" errors without internal paths; avoid exposing sensitive configuration in errors[1]. |
|
|
| Denial of Service (resource exhaustion) | Limit recursive resolution depth; implement timeout; monitor for excessive filesystem operations[1]. |
|
|
|
|
### 7. Risk Ranking
|
|
|
|
- **High:** Path traversal via malicious IDs (if not properly mitigated)
|
|
- **Medium:** Cache tampering or spoofing (if cache is not secured)
|
|
- **Low:** Information disclosure in errors (if error handling is generic)
|
|
|
|
### 8. Next Steps & Review
|
|
|
|
1. **Implement input sanitization for module IDs and configuration.**
|
|
2. **Add resolution depth limiting and timeout.**
|
|
3. **Audit cache handling for race conditions and tampering.**
|
|
4. **Regularly review dependencies for vulnerabilities.**
|
|
5. **Keep documentation and threat model up to date.**
|
|
6. **Monitor for new threats as the ecosystem and library evolve[1][3].**
|
