{"id":105307,"date":"2022-10-14T15:36:38","date_gmt":"2022-10-14T13:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah"},"modified":"2022-10-14T15:36:38","modified_gmt":"2022-10-14T13:36:38","slug":"ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","title":{"rendered":"\u00datok na NPM umo\u017e\u0148uj\u00faci ur\u010di\u0165 pr\u00edtomnos\u0165 bal\u00edkov v priv\u00e1tnych repozit\u00e1roch.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V NPM bola zisten\u00e1 chybn\u00e1 funkcia, ktor\u00e1 umo\u017e\u0148uje zisti\u0165 existenciu bal\u00edkov v uzavret\u00fdch repozit\u00e1roch. Probl\u00e9m je sp\u00f4soben\u00fd r\u00f4znymi \u010dasmi reakcie pri po\u017eiadavke na existuj\u00faci a neexistuj\u00faci bal\u00edk od extern\u00e9ho pou\u017e\u00edvate\u013ea, ktor\u00fd nem\u00e1 pr\u00edstup k repozit\u00e1ru. Pri absencii pr\u00edstupu k ak\u00fdmko\u013evek bal\u00edkom v s\u00fakromn\u00fdch repozit\u00e1roch server registry.npmjs.org vracia chybu s k\u00f3dom \u00ab404\u00bb, ale v pr\u00edpade existencie bal\u00edka s po\u017eadovan\u00fdm n\u00e1zvom je chyba vyhl\u00e1sen\u00e1 s podstatn\u00fdm oneskoren\u00edm. \u00dato\u010dn\u00edk m\u00f4\u017ee vyu\u017ei\u0165 t\u00fato vlastnos\u0165 na ur\u010denie pr\u00edtomnosti bal\u00edka pri v\u00fdbere n\u00e1zvov bal\u00edkov pod\u013ea slovn\u00edkov. <\/p>\n

Ur\u010denie mien bal\u00ed\u010dkov v uzavret\u00fdch repozit\u00e1roch m\u00f4\u017ee by\u0165 potrebn\u00e9 na vykonanie \u00fatoku prostredn\u00edctvom mie\u0161ania z\u00e1vislost\u00ed, manipuluj\u00faceho s prienikom mien z\u00e1vislost\u00ed v verejn\u00fdch a intern\u00fdch repozit\u00e1roch. Ak \u00fato\u010dn\u00edk vie, ak\u00e9 intern\u00e9 NPM bal\u00ed\u010dky s\u00fa pr\u00edtomn\u00e9 v firemn\u00fdch repozit\u00e1roch, m\u00f4\u017ee umiestni\u0165 bal\u00ed\u010dky s rovnak\u00fdmi menami a nov\u0161\u00edmi \u010d\u00edslami verzi\u00ed do verejn\u00e9ho repozit\u00e1ra NPM. Ak nie s\u00fa intern\u00e9 kni\u017enice pri zostavovan\u00ed jasne viazan\u00e9 vo svojich nastaveniach na svoj repozit\u00e1r, bal\u00ed\u010dkov\u00fd mana\u017e\u00e9r npm pova\u017euje verejn\u00fd repozit\u00e1r za prioritnej\u0161\u00ed a na\u010d\u00edta bal\u00ed\u010dek pripraven\u00fd \u00fato\u010dn\u00edkom. <\/p>\n

GitHub bol informovan\u00fd o probl\u00e9me v marci, ale odmietol prida\u0165 ochranu proti \u00fatoku, odvol\u00e1vaj\u00fac sa na architektonick\u00e9 obmedzenia. Firm\u00e1m, ktor\u00e9 pou\u017e\u00edvaj\u00fa s\u00fakromn\u00e9 repozit\u00e1re, sa odpor\u00fa\u010da pravidelne kontrolova\u0165 v\u00fdskyt prenikaj\u00facich mien vo verejnom repozit\u00e1ri alebo vytvori\u0165 vo svojom mene z\u00e1platy s n\u00e1zvami, ktor\u00e9 opakuj\u00fa n\u00e1zvy bal\u00ed\u010dkov v s\u00fakromn\u00fdch repozit\u00e1roch, aby \u00fato\u010dn\u00edci nemohli umiestni\u0165 svoje bal\u00ed\u010dky s podobn\u00fdmi n\u00e1zvami.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043d\u0435\u0434\u043e\u0440\u0430\u0431\u043e\u0442\u043a\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c \u0440\u0435\u0430\u043a\u0446\u0438\u0438 \u043f\u0440\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u0438 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044e. \u041f\u0440\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0434\u043b\u044f \u043b\u044e\u0431\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u0441\u0435\u0440\u0432\u0435\u0440 registry.npmjs.org \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441 \u043a\u043e\u0434\u043e\u043c «404», \u043d\u043e \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430 \u0441 \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c \u043e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0434\u0430\u0451\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105307","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00datok na NPM, ktor\u00fd umo\u017e\u0148uje ur\u010di\u0165 pr\u00edtomnos\u0165 bal\u00ed\u010dkov v s\u00fakromn\u00fdch repozit\u00e1roch | ProHoster","description":"V NPM bola zisten\u00e1 nedokonalos\u0165, ktor\u00e1 umo\u017e\u0148uje ur\u010dova\u0165 existenciu bal\u00ed\u010dkov v uzavret\u00fdch repozit\u00e1roch.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 NPM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 | ProHoster","og:description":"\u0412 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043d\u0435\u0434\u043e\u0440\u0430\u0431\u043e\u0442\u043a\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-14T13:36:38+00:00","article:modified_time":"2022-10-14T13:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/105307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=105307"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/105307\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=105307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=105307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=105307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}