Some thinking to discuss a way to fix the RCE issue

[darxtrix]

Hey,

Attended your session at JSFoo today, liked the answers !

Just wanted to discuss an approach through which Remote Code execution chances can be brought to a very low percentage. This approach can be used

1. Install the package in a sandbox env, for eg. superagent
2. Unless it is used in the code, don't install in main repo, prevent installation before somebody does this:

superagent.get(----)

Then make sure that get method is there corresponding to superagent that is installed in sandbox env, if it is there, then install it. I think this methodology will significantly decrease the chances of RCE ?

[siddharthkp]

Ah this is super interesting. Any idea on how do you detect usage in a generic way?

[darxtrix]

Mostly all my sunny days go by writing Python, will try to figure out something during the conference.