From 825dbdbdc1b958cad1b335512380df422a1e147b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=A1=D0=BA=D0=BE=D0=B2=D0=BE=D1=80=D0=BE=D0=B4=D0=B0=20?=
 =?UTF-8?q?=D0=9D=D0=B8=D0=BA=D0=B8=D1=82=D0=B0=20=D0=90=D0=BD=D0=B4=D1=80?=
 =?UTF-8?q?=D0=B5=D0=B5=D0=B2=D0=B8=D1=87?= <chalkerx@gmail.com>
Date: Sat, 13 Oct 2018 19:40:44 +0300
Subject: [PATCH 1/3] doc: inspector security warning for changing host

Refs: https://github.com/nodejs/node/issues/23444
Refs: https://github.com/nodejs/node/issues/21774
---
 doc/api/cli.md       | 21 +++++++++++++++++++++
 doc/api/inspector.md |  3 +++
 2 files changed, 24 insertions(+)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index a99190c0b47170..5939c38c38b863 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -144,6 +144,9 @@ Useful when activating the inspector by sending the `SIGUSR1` signal.
 
 Default host is `127.0.0.1`.
 
+See the [security warning](#inspector_security) below regarding the `host`
+parameter usage.
+
 ### `--inspect[=[host:]port]`
 <!-- YAML
 added: v6.3.0
@@ -155,6 +158,22 @@ V8 inspector integration allows tools such as Chrome DevTools and IDEs to debug
 and profile Node.js instances. The tools attach to Node.js instances via a
 tcp port and communicate using the [Chrome DevTools Protocol][].
 
+<a id="inspector_security"></a>
+#### Warning: binding inspector to a public IP:port combination is insecure
+
+Binding the inspector to a public IP (including `0.0.0.0`) with an open port is
+insecure, as it allows third-party hosts to connect to the inspector and perform
+a [remote code execution][] attack.
+
+If you specify a host, make sure that at least one of the following is true:
+either the host is not public, or the port is properly firewalled to disallow
+unwanted connections.
+
+**More specifially, `--inspect=0.0.0.0` is insecure if the port (`9229` by
+default) is not firewall-protected.**
+
+See the [debugging security implications][] section for more information.
+
 ### `--loader=file`
 <!--
 added: v9.0.0
@@ -738,6 +757,8 @@ greater than `4` (its current default value). For more information, see the
 [ScriptCoverage]: https://chromedevtools.github.io/devtools-protocol/tot/Profiler#type-ScriptCoverage
 [V8 JavaScript code coverage]: https://v8project.blogspot.com/2017/12/javascript-code-coverage.html
 [debugger]: debugger.html
+[debugging security implications]: https://nodejs.org/en/docs/guides/debugging-getting-started/#security-implications
 [emit_warning]: process.html#process_process_emitwarning_warning_type_code_ctor
 [experimental ECMAScript Module]: esm.html#esm_loader_hooks
 [libuv threadpool documentation]: http://docs.libuv.org/en/latest/threadpool.html
+[remote code execution]: https://www.owasp.org/index.php/Code_Injection
diff --git a/doc/api/inspector.md b/doc/api/inspector.md
index 92fcb0e03f89e4..c3fcabf28dd26c 100644
--- a/doc/api/inspector.md
+++ b/doc/api/inspector.md
@@ -43,6 +43,9 @@ started.
 If wait is `true`, will block until a client has connected to the inspect port
 and flow control has been passed to the debugger client.
 
+See the [security warning](cli.html#inspector_security) regarding the `host`
+parameter usage.
+
 ## inspector.url()
 
 * Returns: {string|undefined}

From 523ff907065cb78bf41b8d7c466b1d684d5558f4 Mon Sep 17 00:00:00 2001
From: Rich Trott <rtrott@gmail.com>
Date: Mon, 5 Nov 2018 22:13:35 -0800
Subject: [PATCH 2/3] fixup (third-party -> external)

---
 doc/api/cli.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 5939c38c38b863..2ff0b559481743 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -162,7 +162,7 @@ tcp port and communicate using the [Chrome DevTools Protocol][].
 #### Warning: binding inspector to a public IP:port combination is insecure
 
 Binding the inspector to a public IP (including `0.0.0.0`) with an open port is
-insecure, as it allows third-party hosts to connect to the inspector and perform
+insecure, as it allows external hosts to connect to the inspector and perform
 a [remote code execution][] attack.
 
 If you specify a host, make sure that at least one of the following is true:

From a716732d2b6ab896bc5c145f410297cbe01db105 Mon Sep 17 00:00:00 2001
From: Rich Trott <rtrott@gmail.com>
Date: Mon, 5 Nov 2018 22:14:35 -0800
Subject: [PATCH 3/3] fixup (speficially -> specifically)

---
 doc/api/cli.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 2ff0b559481743..a84ffc79fb4885 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -169,7 +169,7 @@ If you specify a host, make sure that at least one of the following is true:
 either the host is not public, or the port is properly firewalled to disallow
 unwanted connections.
 
-**More specifially, `--inspect=0.0.0.0` is insecure if the port (`9229` by
+**More specifically, `--inspect=0.0.0.0` is insecure if the port (`9229` by
 default) is not firewall-protected.**
 
 See the [debugging security implications][] section for more information.