joyent/node — pull request #5531 by linusmartensson (2013-05-22 15:37:15+00:00)
Title: Whitelist support

This patch provides granular native API-whitelisting support to NodeJS, which can be used to implement attack vector minimization solutions for both core NodeJS APIs and extension APIs, to reduce volatility when insecure scripts are executed in a NodeJS environment, or when parts of a NodeJS environment is compromised due to unresolved security issues.

The whitelist is activated by use of a "--whitelist arg" flag, and will prevent access to any native API not specified in the whitelist.

The whitelist itself is a set of semi-colon delimited value names or wildcards on the form "a.b.c;a.c.*;" and covers all APIs constructed via Binding, DLOpen, and SetupProcessObject by traversing the returned export object and matching value names to the provided filter specification.