Dashboard › spotlight › Distillation
4ca76d72-2a45-496f-a28d-981eee16c145["b7694ec1e5e20a70b06ade7d8b7f931f","5b1c5d9ff2e3ecf0ad5cf67510b5d250","f427f69f3959d0f370816bea09bd6ae6","e4a8b8d0f4ac1552881a84ea7dbcc256","737593dfe21fd676829751f7c0677bb6","2f3bf42bbfd375c5c6dbb90c11cd2b9e","bb190cde5f5ccc9662c90cc20af91971","01f2bef271f10564cb6d995cadf6aff2","7c74af43381d290a78a37ea4c7971768","41759a9e06869f80e3530cea4b6fce3e","51e81dba29887e80b3bcb09911d1b787","cf129150a3d384ebb537bad649dcf31e","76bed0a7cbdf4ad2635b90e3fdbc3666","8d1f3aef7691d280fcb27551c9a09cbe","4315cb6960e80c1b7c7df385225af73d"]
lib/deno/mod.ts) downloads native binaries without SHA-256 integrity verification; Node.js equivalent (lib/npm/node-install.ts) has binaryIntegrityCheck() at lines 228–234 but it was never implemented for the Deno distributionbinaryIntegrityCheck, binaryHashes, sha256, and hash have never appeared in lib/deno/mod.ts (confirmed via full git history search)lib/deno/mod.ts lines 62–82 — installFromNPM() reads NPM_CONFIG_REGISTRY env var (line 70), constructs URL (line 71), fetches binary (line 72), extracts (line 73), writes with mode: 0o755 (line 80), no hash check (line 81); binary passed to spawn() at line 291binaryIntegrityCheck() called at line 131 (installUsingNPM path) and line 243 (downloadDirectlyFromNPM path) in lib/npm/node-install.tsNPM_CONFIG_REGISTRY=http://127.0.0.1:19876, malicious binary cached at ~/.cache/esbuild/bin/@esbuild-linux-x64@0.28.0; actual built deno/mod.js (built via node scripts/esbuild.js ./esbuild --deno) confirmed vulnerable; Node.js path rejected same binary (fake SHA-256: d85234b9bac94fcda135d112f0c23d9c31bbb14a5502a37e743a3cf2a3750fa1, expected: aafacdf135322bf47c882a4ea4db33d0375583f5b9c3fd2d4e12258e470568be)crypto.subtle.digest("SHA-256", ...) in lib/deno/mod.ts after extraction; (2) validate NPM_CONFIG_REGISTRY URL warns on HTTP; (3) add ESBUILD_BINARY_PATH validation mirroring isValidBinaryPath() from lib/npm/node-platform.tspath.Clean() (POSIX-only, serve_other.go line 165) doesn't normalize \ separators; absPath constructed at line 221 via h.fs.Join(h.servedir, queryPath); allows arbitrary file read outside servedir on Windows only; PoC: curl --path-as-is "http://localhost:8000/..\\..\\..\\..\\..\\..\\..\\Windows\\system.ini"pnpm-lock.yaml: `esbuild@0.25