Security: Global runtime environment object is mutable and exposed by reference#4627
Conversation
… mutable and e `setRuntimeEnv` stores a process-global object and `getRuntimeEnv` returns the same object reference. In long-lived server processes, this can cause cross-request state contamination and accidental or malicious mutation by downstream code, potentially altering security-sensitive runtime behavior. Affected files: runtimeEnv.ts Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>
✅ Deploy Preview for module-federation-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
|
"LGTM. However, since runtimeEnv is already shallow cloned and frozen inside setRuntimeEnv, returning the reference directly in getRuntimeEnv is completely safe and avoids unnecessary object allocation/GC overhead on every getter call.Could we optimize this before merging?" |
2 participants
Problem
setRuntimeEnvstores a process-global object andgetRuntimeEnvreturns the same object reference. In long-lived server processes, this can cause cross-request state contamination and accidental or malicious mutation by downstream code, potentially altering security-sensitive runtime behavior.Severity:
mediumFile:
packages/treeshake-server/src/utils/runtimeEnv.tsSolution
Clone and freeze runtime env on write/read (
Object.freeze({...env})), avoid returning mutable references, and scope environment state per request/context instead of global module state where feasible.Changes
packages/treeshake-server/src/utils/runtimeEnv.ts(modified)Testing