From accb8aec35beb0eaff747434394f5292e6be3050 Mon Sep 17 00:00:00 2001 From: Rich Trott Date: Mon, 28 Jan 2019 16:07:31 -0800 Subject: [PATCH] doc: revise inspect security info in cli.md Revise inspect security information in cli.md. * Reword sentence for brevity. * Use bulleted list for clarity of options. * Eliminate personal pronoun (_you_) per style guide. PR-URL: https://github.com/nodejs/node/pull/25779 Reviewed-By: Vse Mozhet Byt Reviewed-By: Colin Ihrig Reviewed-By: Richard Lau Reviewed-By: James M Snell Reviewed-By: Anna Henningsen --- doc/api/cli.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/doc/api/cli.md b/doc/api/cli.md index 776bfa085bce5c..06de886c69499a 100644 --- a/doc/api/cli.md +++ b/doc/api/cli.md @@ -246,9 +246,10 @@ Binding the inspector to a public IP (including `0.0.0.0`) with an open port is insecure, as it allows external hosts to connect to the inspector and perform a [remote code execution][] attack. -If you specify a host, make sure that at least one of the following is true: -either the host is not public, or the port is properly firewalled to disallow -unwanted connections. +If specifying a host, make sure that either: + +* The host is not accessible from public networks. +* A firewall disallows unwanted connections on the port. **More specifically, `--inspect=0.0.0.0` is insecure if the port (`9229` by default) is not firewall-protected.**