{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/2943","labels_url":"https://api.github.com/repos/nodejs/node/issues/2943/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/2943/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/2943/events","html_url":"https://github.com/nodejs/node/issues/2943","id":107147866,"number":2943,"title":"Release Proposal: v4.1.1","user":{"login":"trevnorris","id":289174,"avatar_url":"https://avatars.githubusercontent.com/u/289174?v=3","gravatar_id":"","url":"https://api.github.com/users/trevnorris","html_url":"https://github.com/trevnorris","followers_url":"https://api.github.com/users/trevnorris/followers","following_url":"https://api.github.com/users/trevnorris/following{/other_user}","gists_url":"https://api.github.com/users/trevnorris/gists{/gist_id}","starred_url":"https://api.github.com/users/trevnorris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trevnorris/subscriptions","organizations_url":"https://api.github.com/users/trevnorris/orgs","repos_url":"https://api.github.com/users/trevnorris/repos","events_url":"https://api.github.com/users/trevnorris/events{/privacy}","received_events_url":"https://api.github.com/users/trevnorris/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/meta","name":"meta","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-09-18T07:22:13Z","updated_at":"2015-09-18T08:14:42Z","closed_at":null,"body":"Contains fix that prevents `ArrayBuffer`s from possibly returning non zero filled memory.\r\n\r\n* [0a329d2d] - **buffer**: don't set zero fill for zero-length buffer (Trevor Norris) https://github.com/nodejs/node/pull/2931\r\n\r\n@nodejs/release "},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/141377826","html_url":"https://github.com/nodejs/node/issues/2943#issuecomment-141377826","issue_url":"https://api.github.com/repos/nodejs/node/issues/2943","id":141377826,"user":{"login":"rvagg","id":495647,"avatar_url":"https://avatars.githubusercontent.com/u/495647?v=3","gravatar_id":"","url":"https://api.github.com/users/rvagg","html_url":"https://github.com/rvagg","followers_url":"https://api.github.com/users/rvagg/followers","following_url":"https://api.github.com/users/rvagg/following{/other_user}","gists_url":"https://api.github.com/users/rvagg/gists{/gist_id}","starred_url":"https://api.github.com/users/rvagg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rvagg/subscriptions","organizations_url":"https://api.github.com/users/rvagg/orgs","repos_url":"https://api.github.com/users/rvagg/repos","events_url":"https://api.github.com/users/rvagg/events{/privacy}","received_events_url":"https://api.github.com/users/rvagg/received_events","type":"User","site_admin":false},"created_at":"2015-09-18T08:14:42Z","updated_at":"2015-09-18T08:14:42Z","body":"> TypedArrays not being zero-filled in some cases (especially those that are triggerable by user actions) is a security issue no matter how one views it.\r\n\r\nIn the browser, that's why they are zero-filled by default in the browser because it's a sandbox, which Node is not and which is we don't zero-fill buffers, this is a break in assumptions and therefore a bug. By \"doing something\" I'm saying that you'd need to get the TypedArray data _out of the server_, so it's indeed an extra step, just because it exists in memory on the server doesn't make it an exploit."}}