Merge pull request #19 from ossf/js-bp

✨ initial guidance for JS memory management
ossf · Jan 25, 2024 · 4e7063d · 4e7063d
2 parents 71e95a7 + 8f83bff
commit 4e7063d
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/docs/best-practice-memory-safe-by-default-languages.md b/docs/best-practice-memory-safe-by-default-languages.md
@@ -1,6 +1,6 @@
 # Best Practices - Memory-Safe By Default Languages
 
-While Memory-Safe by default languages are, by definition, memory safe by default, there are ways that the can be used unsafely (or less safely). Here are best developer practices for using these languages.
+While Memory-Safe by default languages are, by definition, memory-safe by default, there are ways that they can be used unsafely (or less safely). Here are best developer practices for using these languages.
 
 ## Python
 
@@ -22,6 +22,10 @@ TO DO
 
 TO DO
 
+## JavaScript
+
+* Follow the [Memory management guide](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Memory_management)
+
 ## Java
 
 TO DO
diff --git a/docs/revised-stream-4-language.md b/docs/revised-stream-4-language.md
@@ -13,7 +13,7 @@ In this doc we have standardized on this terminology/spelling:
 
 It is common for vulnerabilities to result from a program mismanaging memory. These types of vulnerabilities are called memory safety vulnerabilities.
 
-Some programming languages, including Rust, Go, and Java, are commonly referred to as "memory-safe languages". By default, these languages prevent programmers from making the mistakes that result in classes of memory safety vulnerabilities. Other languages, including C and C++, are commonly referred to as "memory unsafe languages". Be default, these languages do not prevent programmers from making the mistakes that result in classes of memory safety vulnerabilities.
+Some programming languages, including Rust, Go, JavaScript, and Java, are commonly referred to as "memory-safe languages". By default, these languages prevent programmers from making the mistakes that result in classes of memory safety vulnerabilities. Other languages, including C and C++, are commonly referred to as "memory unsafe languages". Be default, these languages do not prevent programmers from making the mistakes that result in classes of memory safety vulnerabilities.
 
 Microsoft estimates that 70% of the vulnerabilities in its products (those that were built with memory unsafe languages) over the past decade are memory safety vulnerabilities[^1]. Google estimates that 90% of vulnerabilities in Android media and Bluetooth components are memory safety vulnerabilities[^2].