Node.js sounds the alarm: code used by Netflix has a critical flaw
cybernews.com
10 vulnerabilities make Node.js security updates urgent for services using Brotli, TLS, DNS, and files. See which risks admins face

Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.

  • Siru@discuss.tchncs.deEnglish
    12·
    17 hours ago

    Has pure HTML (no css, no javascript) ever had a serious security issue? On the server side obviously not (outside of the apache/nginx/etc. having application bugs), but even on the client side has there ever been an exploit?

    • xthexder@l.sw0.comEnglish
      8·
      16 hours ago

      I think there’s been one or two image decompression exploits over the years, so a site with a malicious file could end up running code on your system. I remember this being an issue with Minecraft clients and player skins at one point, but I can’t remember any specific times this happened in browsers tho.

    • Zarobi@aussie.zoneEnglish
      74·
      13 hours ago

      Yeah but if it’s just pure HTML you got an ugly-ass website that’s annoying to use. There’s been many JavaScript and css vulnerabilities over the years of course. But yes there was and still is plain HTML issues

      Client side:

      • I vaguely remember some base64 embedded encoding malware.
      • I do believe there was some issues with early HTML, if you had malformed tags, that could bypass checks and balances.
      • Svg, Images, audio, fonts, and video can definitely contain malware. Before you say fonts are a css thing, <font> was a real tag
      • IFrames were the worst:
        • They had too much power in the past and could hijack the page and browser.
        • There was no content security policy back then so they could inject JavaScript into the main page as well.
        • Also they can cover the whole screen and present a normal login screen, and hijack all inputs going through it. Think of it like you’re on dodgey-site.com and it has a full page IFrame to bank.com. This was a common hack back in the day which inspired an entire http header to help prevent this.
      • Anchor tags can link to something dodgey of course.
      • Embedded PDFs were a huge issue.
      • ActiveX and other web applets was just fucked. They were so bad they caused malware constantly. This is where unsolicited toolbars came from.
      • Adobe Flash had many many vulnerabilities over the years.
      • Canvas bugs are still a thing today.

      Server side, you could execute SQL injection and path traversal just via URL before the page even loads. Malware and other issues can be embedded in text inputs. HTML can be uploaded to the server and in some cases replayed on the page affecting other users (comment sections were infamous for this).

      So yeah; a plain HTML page with no JavaScript or css isn’t necessarily safe

        • Zarobi@aussie.zoneEnglish
          21·
          8 hours ago

          Oh yeah, everyone loves black text on white background, with each div placed sequentially in a vertical stack :) really gives it that vintage mid 90’s dial up internet “the website failed to load CSS” look

          There’s nothing wrong with CSS. Arguably it’s been overcomplicated way beyond it’s original scope, but it works as designed to make your sites look good

    • AlphaOmega@lemmy.worldEnglish
      2·
      13 hours ago

      I build custom websites that run primarily on css and html. Light JS for applications, and some simple PHP to tie everything together. I am unaware of any flaw or exploit that would disable my sites. I don’t recall any html vulnerabilities. Unless there’s e-commerce involved, that’s nothing I can think of that would be exploitable on either side for html or css. These are both hard coded into the browser so I’m not even sure what an exploit would accomplish other than changing values on the client side. But it’s been a long week…

      Edit Looks like zarobi below remembered some exploits. Totally forgot about iframes and the weird image data exploits.