- Jun 13, 2018
-
-
Rich Trott authored
The CODEOWNERS file is not working out. It is not pinging any groups other than TSC (and more-or-less can't), and it pings TSC mostly for all the wrong things. It was a valiant effort, and possible worth revisiting at a future date when functionality is closer to what we need. But for now, let us bid it adieu. PR-URL: https://github.com/nodejs/node/pull/21161 Reviewed-By:
Myles Borins <myles.borins@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Ali Ijaz Sheikh <ofrobots@google.com> Reviewed-By:
Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Tiancheng "Timothy" Gu <timothygu99@gmail.com> Reviewed-By:
Ujjwal Sharma <usharma1998@gmail.com>
-
Rich Trott authored
Provide more concise explanations of the deprecation levels in COLLABORATOR_GUIDE.md. PR-URL: https://github.com/nodejs/node/pull/21241 Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Yuta Hiroto <hello@hiroppy.me> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By:
Weijia Wang <starkwang@126.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
-
James M Snell authored
PR-URL: https://github.com/nodejs-private/node-private/pull/117 Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Evan Lucas <evanlucas@me.com>
-
James M Snell authored
This fixes CVE-2018-1000168. PR-URL: https://github.com/nodejs-private/node-private/pull/117 Reviewed-By:
-
James M Snell authored
This fixes CVE-2018-7161. PR-URL: https://github.com/nodejs-private/node-private/pull/115 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
-
Anna Henningsen authored
This would otherwise keep a lot of unused memory lying around, and in particular add up to a page per chunk of memory overhead for network reads, potentially opening a DoS vector if the resulting `Buffer` objects are kept around indefinitely (e.g. stored in a list and not concatenated until the socket finishes). This fixes CVE-2018-7164. Refs: https://github.com/nodejs-private/security/issues/186 Refs: https://github.com/nodejs/node/commit/7c4b09b24bbe7d6a8cbad256f47b30a101a909ea PR-URL: https://github.com/nodejs-private/node-private/pull/128 Reviewed-By:
-
Shigeki Ohtsu authored
Add a mock TLS socket implementation and a regression test for the previous commit. Refs: https://github.com/nodejs-private/security/issues/189 PR-URL: https://github.com/nodejs-private/node-private/pull/127 Reviewed-By:
-
Anna Henningsen authored
Fix an use-after-free bug in the TLS implementation. If we return from `DoWrite()` with an early error, we should not be storing the `WriteWrap` object and complete it again at a later point, when it has already been freed (because of the write error). This issue was reported by Jordan Zebor at F5 Networks, who also helped with investigating this bug and coming up with a reproduction. This fixes CVE-2018-7162. Fixes: https://github.com/nodejs-private/security/issues/189 PR-URL: https://github.com/nodejs-private/node-private/pull/127 Reviewed-By:
-
Evan Lucas authored
Notable changes: * **Fixes memory exhaustion DoS** (CVE-2018-7164): Fixes a bug introduced in 9.7.0 that increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. * **http2** * (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup * (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0 * **tls** (CVE-2018-7162): Fixes Denial of Service vulnerability by updating the TLS implementation to not crash upon receiving * **n-api**: Prevent use-after-free in napi_delete_async_work PR-URL: https://github.com/nodejs-private/node-private/pull/136 -
Evan Lucas authored
Notable changes: * **Fixes memory exhaustion DoS** (CVE-2018-7164): Fixes a bug introduced in 9.7.0 that increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. * **buffer** (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang * **http2** * (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup * (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0 * **tls** (CVE-2018-7162): Fixes Denial of Service vulnerability by updating the TLS implementation to not crash upon receiving PR-URL: https://github.com/nodejs-private/node-private/pull/135 -
Evan Lucas authored
Notable changes: * **buffer** (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang * **http2** * (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup * (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0 PR-URL: https://github.com/nodejs-private/node-private/pull/126 -
Evan Lucas authored
Notable changes: * **buffer** (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang PR-URL: https://github.com/nodejs-private/node-private/pull/134
-
- Jun 12, 2018
-
-
Jeremiah Senkpiel authored
This was previously incorrect. PR-URL: https://github.com/nodejs/node/pull/21180 Reviewed-By:
Minwoo Jung <minwoo@nodesource.com> Reviewed-By:
-
Jeremiah Senkpiel authored
This functionality works but was previously untested. PR-URL: https://github.com/nodejs/node/pull/21180 Reviewed-By:
-
Rich Trott authored
Mark test-inspector-port-zero-cluster flaky on Linux. Also, alphabetize win32 entries in status file. PR-URL: https://github.com/nodejs/node/pull/21251 Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
-
Richard Lau authored
Run `make lint-md-build` to install the markdown linter. PR-URL: https://github.com/nodejs/node/pull/21215 Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
-
Evan Lucas authored
This reverts commit c2c9c0c3. It seems to be causing hangs when piping output to other processes. PR-URL: https://github.com/nodejs/node/pull/21257 Reviewed-By:
-
Anna Henningsen authored
Otherwise, closing all handles associated with the main event loop would also mean that `uv_tty_reset_mode()` can’t function properly because the corresponding FDs have already been closed. Fixes: https://github.com/nodejs/node/issues/21020 PR-URL: https://github.com/nodejs/node/pull/21257 Reviewed-By:
-
Anna Henningsen authored
Use a JS script to build addons rather than a shell command embedded in the Makefile, because parallelizing is hard in sh and easy in JS. PR-URL: https://github.com/nodejs/node/pull/21155 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
-
Shelley Vohr authored
PR-URL: https://github.com/nodejs/node/pull/21187 Reviewed-By:
-
Anatoli Papirovski authored
PR-URL: https://github.com/nodejs/node/pull/21194 Reviewed-By:
-
Anatoli Papirovski authored
It's hypothetically (and with certain V8 flags) possible for the session to be garbage collected before all the streams are. In that case, trying to remove the stream from the session will lead to a segfault due to attempting to access no longer valid memory. Fix this by unsetting the session on any streams still around when destroying. PR-URL: https://github.com/nodejs/node/pull/21194 Reviewed-By:
-
- Jun 11, 2018
-
-
Daniel Bevenius authored
This commit adds a crypto check to test-http2-debug.js as it currently will error if configured --without-ssl. The issue here is that the while the test spawns a child process that runs test-http2-ping.js, which does have a crypto check, it will just print '1..0 # Skipped: missing crypto' to stdout, and nothing to stderr which is what this test is trying to assert and hence failing. PR-URL: https://github.com/nodejs/node/pull/21205 Reviewed-By:
Daijiro Wachi <daijiro.wachi@gmail.com> Reviewed-By:
-
Mark S. Everitt authored
Fixes: https://github.com/nodejs/node/issues/21202 PR-URL: https://github.com/nodejs/node/pull/21214 Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
-
James Kylstra authored
In test/parallel/test-intl.js, five calls to assert.strictEqual() use a third, string-literal parameter, which specifies a message to display when the assertion fails. The problem is that if the assertion fails, the error message will show the string literal but not the values that caused the assertion to fail. This commit removes the third parameter from the five calls and makes them comments above the assertions instead. The default error message produced by assert.strictEqual() shows the values that caused the assertion to fail, which should be somewhat more helpful. PR-URL: https://github.com/nodejs/node/pull/21211 Reviewed-By:
-
Rich Trott authored
test-inspector-stress-http launches 100 simultaneous http requests. It is unreliable in the parallel directory (as can be seen with tools/test.py and sufficiently high -j and --repeat values). Move to sequential. PR-URL: https://github.com/nodejs/node/pull/21227 Reviewed-By:
Jon Moss <me@jonathanmoss.me> Reviewed-By:
-
Nikolai Vavilov authored
PR-URL: https://github.com/nodejs/node/pull/21237 Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
-
- Jun 10, 2018
-
-
Michaël Zasso authored
Refs: https://github.com/v8/v8/compare/6.7.288.44...6.7.288.45 PR-URL: https://github.com/nodejs/node/pull/21192 Reviewed-By:
-
Rich Trott authored
This small change makes addon test build successfully with LLVM 10.0.0 and above. This will be fixed in npm source when node-gyp is updated to 3.6.3 or above. PR-URL: https://github.com/nodejs/node/pull/21239 Reviewed-By:
-
Anatoli Papirovski authored
PR-URL: https://github.com/nodejs/node/pull/21093 Fixes: https://github.com/nodejs/node/issues/18190 Refs: https://github.com/nodejs/node/pull/18307 Reviewed-By:
Jeremiah Senkpiel <fishrock123@rocketmail.com> Reviewed-By:
-
Anatoli Papirovski authored
Instead of relying on garbage collection to close the handle, manage its state more explicitly. PR-URL: https://github.com/nodejs/node/pull/21093 Fixes: https://github.com/nodejs/node/issues/18190 Refs: https://github.com/nodejs/node/pull/18307 Reviewed-By:
-
Anatoli Papirovski authored
Instead of relying on garbage collection to close the timer handle, manage its state more explicitly. PR-URL: https://github.com/nodejs/node/pull/21093 Fixes: https://github.com/nodejs/node/issues/18190 Refs: https://github.com/nodejs/node/pull/18307 Reviewed-By:
-
- Jun 09, 2018
-
-
Misty De Meo authored
Compare versions using tuples instead of strings so that it is future-proofed against versions that contain a number that is more than one digit. PR-URL: https://github.com/nodejs/node/pull/21183 Reviewed-By:
-
Aliaksei Tuzik authored
Extend return type of `read()` method with `any` which is a valid return type for readable streams in object mode. PR-URL: https://github.com/nodejs/node/pull/21178 Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com>
-
Ujjwal Sharma authored
Stop `make distclean` from deleting files in the `deps/v8/testing/gmock` folder, thus avoiding deleting version-controlled files important for v8. Fixes: https://github.com/nodejs/node/issues/21163 PR-URL: https://github.com/nodejs/node/pull/21164 Reviewed-By:
-
Hristijan Gjorgjievski authored
Improve the assert error message so it includes actual value in the error message. PR-URL: https://github.com/nodejs/node/pull/21160 Reviewed-By:
-
Jamie Davis authored
Issue 1: make invalid setServers yield uniform error Behavior: dns.setServers throws a null pointer dereference on some inputs. Expected behavior was the more pleasant TypeError [ERR_INVALID_IP_ADDRESS] ... Root cause(s?): - Dereferencing the result of a regex match without confirming that there was a match. - assuming the capture of an optional group (?) Solution: Confirm the match, and handle a missing port cleanly. Tests: I added tests for various unusual inputs. Issue 2: revise quadratic regex in setServers Problem: The IPv6 regex was quadratic. On long malicious input the event loop could block. The security team did not deem it a security risk, but said a PR was welcome. Solution: Revise the regex to a linear-complexity version. Tests: I added REDOS tests to the "oddities" section. Fixes: https://github.com/nodejs/node/issues/20441 Fixes: https://github.com/nodejs/node/issues/20443 PR-URL: https://github.com/nodejs/node/pull/20445 Reviewed-By:
-
Rich Trott authored
LC_ALL=en_US breaks on some systems (notably the SmartOS 16 configuration in our CI). Use LC_ALL=C instead. PR-URL: https://github.com/nodejs/node/pull/21222 Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
-
Rich Trott authored
Using High Sierra and `xcode-select --install` without installing full Xcode, our build tooling breaks due to faulty regular expressions. Update the `configure` script in our project root directory to handle multi-digit version numbers. `tools/gyp` and `deps/npm/node_modules/node-gyp` still need to be updated for a complete fix. PR-URL: https://github.com/nodejs/node/pull/21173 Reviewed-By:
-
Rich Trott authored
Tool versions can be 10 and higher. Float patch from node-gyp to accommodate this fact of life. PR-URL: https://github.com/nodejs/node/pull/21216 Refs: https://github.com/nodejs/node-gyp/commit/293092c362febffe19f72712467565045e08e8f1 Reviewed-By:
-
