301194963b
一些检查失败了
automerge / automerge (push) Has been cancelled
react-native-android-build-apk / AssembleRelease (push) Has been cancelled
Build macOS M1 / Main (push) Has been cancelled
Joplin Continuous Integration / Main (macos-15-intel) (push) Has been cancelled
Joplin Continuous Integration / Main (ubuntu-22.04) (push) Has been cancelled
Joplin Continuous Integration / Main (ubuntu-22.04-arm) (push) Has been cancelled
Joplin Continuous Integration / Main (windows-11-vs2026-arm) (push) Has been cancelled
Joplin Continuous Integration / Main (windows-2025) (push) Has been cancelled
Joplin Continuous Integration / ServerDockerImage (ubuntu-22.04) (push) Has been cancelled
Joplin Continuous Integration / ServerDockerImage (ubuntu-22.04-arm) (push) Has been cancelled
Joplin UI tests / Main (ubuntu-22.04) (push) Has been cancelled
Joplin UI tests / Main (windows-2025) (push) Has been cancelled
Joplin UI tests / Mobile (push) Has been cancelled
Close stale issues / ProcessStaleIssues (push) Has been cancelled
10 行
765 B
Markdown
10 行
765 B
Markdown
# Joplin Server hardening
|
|
|
|
Joplin Server enables one or more hardening options provided by Node.js. These options reduce attack surface and make it more difficult to exploit certain types of vulnerabilities.
|
|
|
|
## How it works
|
|
|
|
Joplin Server's main entrypoint, `index.ts` calls a secondary entrypoint (`app.ts`) with certain [`NODE_OPTIONS`](https://nodejs.org/api/cli.html#options) set. If hardening is enabled, these `NODE_OPTIONS` currently include:
|
|
- [`--disable-proto=delete`](https://nodejs.org/api/cli.html#disable-protomode): Removes the deprecated `__proto__` property. This makes [prototype pollution](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution) attacks [more difficult](https://github.com/nodejs/node/issues/31951).
|
|
|