- Nov 28, 2018
-
-
Richard Lau authored
Run `make lint-md-build` to install the markdown linter. PR-URL: https://github.com/nodejs/node/pull/21215 Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
Tiancheng "Timothy" Gu <timothygu99@gmail.com>
-
Anna Henningsen authored
Refs: https://github.com/ayojs/ayo/pull/14 Refs: https://github.com/ayojs/ayo/pull/75 Co-authored-by:
Jeremiah Senkpiel <fishrock123@rocketmail.com> PR-URL: https://github.com/nodejs/node/pull/21059 Reviewed-By:
Jon Moss <me@jonathanmoss.me> Reviewed-By:
Ali Ijaz Sheikh <ofrobots@google.com> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
Shingo Inoue <leko.noor@gmail.com> Reviewed-By:
Matheus Marchini <matheus@sthima.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
-
Shelley Vohr authored
PR-URL: https://github.com/nodejs/node/pull/23763 Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
Nolan Rigo authored
PR-URL: https://github.com/nodejs/node/pull/23800 Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Shelley Vohr <codebytere@gmail.com>
-
erickwendel authored
PR-URL: https://github.com/nodejs/node/pull/23605 Reviewed-By:
Denys Otrishko <shishugi@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com> Reviewed-By:
-
Daniel Bevenius authored
This commit introduces a SET_INTEGER_CONSANT macro to reduce some code duplication in SecureContext::Initialize. PR-URL: https://github.com/nodejs/node/pull/23687 Reviewed-By:
Tobias Nießen <tniessen@tnie.de> Reviewed-By:
-
Steven R. Loomis authored
ICU 62.1 had a bug where certain orders of operations would not work with the minimum significant digit setting. Fixed in ICU 63.1. Applied the following patch from v8. https://chromium-review.googlesource.com/c/chromium/deps/icu/+/1128503 ICU Bug: https://unicode-org.atlassian.net/browse/ICU-20063 Fixes: https://github.com/nodejs/node/issues/22156 PR-URL: https://github.com/nodejs/node/pull/23764 Reviewed-By:
-
Phillip Johnsen authored
Moving @phillipj to emeriti as he has not been an active collaborator for a long time, and will not have the opportunity to do so in the near future. PR-URL: https://github.com/nodejs/node/pull/23790 Reviewed-By:
Сковорода Никита Андреевич <chalkerx@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com>
-
James M Snell authored
Fixes: https://github.com/nodejs/node/issues/21635 PR-URL: https://github.com/nodejs/node/pull/23762 Reviewed-By:
Matheus Marchini <mat@mmarchini.me> Reviewed-By:
-
James M Snell authored
Fixes: https://github.com/nodejs/node/issues/19192 PR-URL: https://github.com/nodejs/node/pull/23772 Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Bartosz Sosnowski <bartosz@janeasystems.com>
-
James M Snell authored
Fixes: https://github.com/nodejs/node/issues/12572 Refs: https://github.com/nodejs/node/pull/16240 PR-URL: https://github.com/nodejs/node/pull/23746 Reviewed-By:
-
Bartosz Sosnowski authored
Creating directory symlinks on Windows require 'dir' parameter to be provided. Fixes: https://github.com/nodejs/node/issues/23596 PR-URL: https://github.com/nodejs/node/pull/23691 Reviewed-By:
-
Romain Lanz authored
PR-URL: https://github.com/nodejs/node/pull/23768 Reviewed-By:
-
Thomas GENTILHOMME authored
PR-URL: https://github.com/nodejs/node/pull/23771 Reviewed-By:
-
Sam Roberts authored
PR-URL: https://github.com/nodejs/node/pull/23678 Reviewed-By:
-
Elian Gutierrez authored
PR-URL: https://github.com/nodejs/node/pull/23787 Reviewed-By:
-
James M Snell authored
PR-URL: https://github.com/nodejs/node/pull/23745 Fixes: https://github.com/nodejs/node/issues/9822 Reviewed-By:
-
Vasili Skurydzin authored
Floating this patch since the code does not exist upstream anymore. deps/v8/testing/gtest.gyp: Supperss -Wnonnull-compare, -Waddress warnings for deps/v8/testing/gtest project; deps/v8/src/compiler/store-store-elimination.cc, deps/v8/src/conversions.cc: Suppress unused function warnings in order to compile with newer (>4.8.5) gcc on Aix. PR-URL: https://github.com/nodejs/node/pull/23958 Reviewed-By:
Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By:
George Adams <george.adams@uk.ibm.com>
-
Vasili Skurydzin authored
Original commit message: ppc64, aix: Pass CallFrequency object by const reference to avoid value copy error. Bug: v8:8193 GCC bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61976 Change-Id: I0d4efca4da03ef82651325e15ddf2160022bc8de Reviewed-on: https://chromium-review.googlesource.com/1228633 Reviewed-by:Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Daniel Clifford <danno@chromium.org> Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#56275} PR-URL: https://github.com/nodejs/node/pull/23958 Reviewed-By:
-
Vasili Skurydzin authored
Only changes to src/base/debug/stack_trace_posix.cc included Original commit message: Fixes to V8 GN build process on aix platform src/base/debug/stack_trace_posix.cc: suppressed unused function warnings for functions DemangleSymbols, OutputPointer(in order to compile with -Werror flag) test/cctest/test-isolate-independent-builtins.cc: corrections to make ByteInText test case compatible with aix. (affects aix only) Change-Id: I49e45e63545404c77aaed3f51b26557f6f03455e Reviewed-on: https://chromium-review.googlesource.com/927484 Reviewed-by:Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#52071} PR-URL: https://github.com/nodejs/node/pull/23958 Reviewed-By:
-
Rod Vagg authored
PR-URL: https://github.com/nodejs-private/node-private/pull/154
-
- Nov 27, 2018
-
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) * Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js) * Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) * Node.js: HTTP request splitting (CVE-2018-12116) * OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734) * OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) Notable Changes: * deps: Upgrade to OpenSSL 1.0.2q, fixing CVE-2018-0734 and CVE-2018-5407 * http: * Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina) * A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with `server.headersTimeout`. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with `server.setTimeout()`, this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). * Two-byte characters are now strictly disallowed for the `path` option in HTTP client requests. Paths containing characters outside of the range `\u0021` - `\u00ff` will now be rejected with a `TypeError`. This behavior can be reverted if necessary by supplying the `--security-revert=CVE-2018-12116` command line argument (this is not recommended). Reported as security concern for Node.js 6 and 8 by Arkadiy Tetelman (lob.com), fixed by backporting a change by Benno Fünfstück applied to Node.js 10 and later. (CVE-2018-12116 / Matteo Collina) * url: Fix a bug that would allow a hostname being spoofed when parsing URLs with `url.parse()` with the `'javascript:'` protocol. Reported by Martin Bajanik (kenticocloud.com). (CVE-2018-12123 / Matteo Collina) PR-URL: https://github.com/nodejs-private/node-private/pull/154
-
Matteo Collina authored
PR-URL: https://github.com/nodejs-private/node-private/pull/146 Reviewed-By:
-
Benno Fünfstück authored
CVE-2018-12116 Backport of b961d9fd to 8.x Original commit: This commit changes node's handling of two-byte characters in the path component of an http URL. Previously, node would just strip the higher byte when generating the request. So this code: ``` http.request({host: "example.com", port: "80", "/Ｎ"}) ``` would request `http://example.com/.` (`.` is the character for the byte `0x2e`). This is not useful and can in some cases lead to filter evasion. With this change, the code generates `ERR_UNESCAPED_CHARACTERS`, just like space and control characters already did. PR-URL: https://github.com/nodejs/node/pull/16237 Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
-
Matteo Collina authored
CVE-2018-12123 Fixes: https://github.com/nodejs-private/security/issues/205 PR-URL: https://github.com/nodejs-private/node-private/pull/145 Reviewed-By:
-
Matteo Collina authored
CVE-2018-12122 An attacker can send a char/s within headers and exahust the resources (file descriptors) of a system even with a tight max header length protection. This PR destroys a socket if it has not received the headers in 40s. PR-URL: https://github.com/nodejs-private/node-private/pull/151 Ref: https://github.com/nodejs-private/node-private/pull/144 Reviewed-By:
-
Matteo Collina authored
CVE-2018-12121 PR-URL: https://github.com/nodejs-private/node-private/pull/143 Ref: https://github.com/nodejs-private/security/issues/139 Ref: https://github.com/nodejs-private/http-parser-private/pull/2 Reviewed-By:
Rod Vagg <rod@vagg.org> Reviewed-By:
-
- Nov 24, 2018
-
-
Shigeki Ohtsu authored
In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Fixes: https://github.com/nodejs/io.js/issues/1461 PR-URL: https://github.com/nodejs/io.js/pull/1836 Reviewed-By:
-
Shigeki Ohtsu authored
Reapply b9106137 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
-
Shigeki Ohtsu authored
See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
-
Fedor Indutny authored
`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Shigeki Ohtsu <ohtsu@iij.ad.jp>
-
Sam Roberts authored
All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Header files were generated by: $ cd deps/openssl $ mkdir -p openssl/include/openssl $ tar xf .../openssl-1.02q.tar.gz $ cd openssl-1.02q $ ./config $ cd include/openssl $ sed -i '' *.h $ cp *.h ../../../openssl/include/openssl/ PR-URL: https://github.com/nodejs/node/pull/24530 Reviewed-By:
Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By:
-
Sam Roberts authored
This updates all sources in deps/openssl/openssl with openssl-1.0.2q. PR-URL: https://github.com/nodejs/node/pull/24530 Reviewed-By:
-
- Nov 20, 2018
-
-
Myles Borins authored
PR-URL: https://github.com/nodejs/node/pull/23974
-
Beth Griggs authored
Notable changes: * **assert**: - backport some assert commits (Ruben Bridgewater) [#23223](https://github.com/nodejs/node/pull/23223) * **deps**: - upgrade to libuv 1.23.2 (cjihrig) [#23336](https://github.com/nodejs/node/pull/23336) - V8: cherry-pick 64-bit hash seed commits (Yang Guo) [#23274](https://github.com/nodejs/node/pull/23274) * **http**: - added aborted property to request (Robert Nagy) [#20094](https://github.com/nodejs/node/pull/20094) * **http2**: - graduate from experimental (James M Snell) [#22466](https://github.com/nodejs/node/pull/22466) PR-URL: https://github.com/nodejs/node/pull/23974 -
Ali Ijaz Sheikh authored
CheckMemoryPressure cannot be used ABI-safely from v8.h. Add a alternate implementation of AdjustAmountOfExternalAllocatedMemory and then use that from Node. PR-URL: https://github.com/nodejs/node/pull/24499 Reviewed-By:
Yang Guo <yangguo@chromium.org> Reviewed-By:
Myles Borins <myles.borins@gmail.com>
-
Ali Ijaz Sheikh authored
d868eb78 ended up being an inadvertant ABI change. Remove the call to CheckMemoryPressure from the header itself. PR-URL: https://github.com/nodejs/node/pull/24499 Reviewed-By:
-
- Nov 11, 2018
-
-
cjihrig authored
Backport-PR-URL: https://github.com/nodejs/node/pull/24103 PR-URL: https://github.com/nodejs/node/pull/23336 Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
-
Ben Noordhuis authored
An upcoming change in libuv will remove the artificial EISDIR error. Update the test to reflect that. Refs: https://github.com/libuv/libuv/pull/2025 Backport-PR-URL: https://github.com/nodejs/node/pull/24103 PR-URL: https://github.com/nodejs/node/pull/23330 Reviewed-By:
Santiago Gimeno <santiago.gimeno@gmail.com> Reviewed-By:
-
cjihrig authored
Backport-PR-URL: https://github.com/nodejs/node/pull/24103 PR-URL: https://github.com/nodejs/node/pull/22997 Reviewed-By:
-
