- Jun 13, 2018
-
-
Ben Noordhuis authored
Rename it to validateArrayBufferView() to align with validateInt32() and friends. Swap the name and the value in the argument list for consistency, although any reasonable person will agree it's a crime against humanity to put the value before the name. PR-URL: https://github.com/nodejs/node/pull/20816 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Tobias Nießen <tniessen@tnie.de>
-
Ben Noordhuis authored
PR-URL: https://github.com/nodejs/node/pull/20816 Reviewed-By:
-
Ben Noordhuis authored
Add scrypt functions to the list of exported openssl symbols. PR-URL: https://github.com/nodejs/node/pull/20816 Reviewed-By:
-
Ben Noordhuis authored
PR-URL: https://github.com/nodejs/node/pull/20816 Reviewed-By:
-
Ben Noordhuis authored
Use the scrypt() infrastructure to reimplement randomBytes() and randomFill() in a simpler manner. PR-URL: https://github.com/nodejs/node/pull/20816 Reviewed-By:
-
Ben Noordhuis authored
Use the scrypt() infrastructure to reimplement pbkdf2() in a simpler manner. PR-URL: https://github.com/nodejs/node/pull/20816 Reviewed-By:
-
Ben Noordhuis authored
Scrypt is a password-based key derivation function that is designed to be expensive both computationally and memory-wise in order to make brute-force attacks unrewarding. OpenSSL has had support for the scrypt algorithm since v1.1.0. Add a Node.js API modeled after `crypto.pbkdf2()` and `crypto.pbkdf2Sync()`. Changes: * Introduce helpers for copying buffers, collecting openssl errors, etc. * Add new infrastructure for offloading crypto to a worker thread. * Add a `AsyncWrap` JS class to simplify pbkdf2(), randomBytes() and scrypt(). Fixes: https://github.com/nodejs/node/issues/8417 PR-URL: https://github.com/nodejs/node/pull/20816 Reviewed-By:
-
Ben Noordhuis authored
Factor out some common code. The `checkUint()` function will also be used in a follow-up commit that adds scrypt support to core. PR-URL: https://github.com/nodejs/node/pull/20816 Reviewed-By:
-
Anna Henningsen authored
Right now, we crash the process if there are handles remaining on the event loop when we exit (except for the main thread). This does not provide a lot of information about causes, though; in particular, we don’t show which handles are pending and who own them. This patch adds debug output to these cases to help with the situation. PR-URL: https://github.com/nodejs/node/pull/21238 Reviewed-By:
Tiancheng "Timothy" Gu <timothygu99@gmail.com> Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By:
-
Anna Henningsen authored
Use a single file, and a single interface, for inspecting symbols in the current process for debugging. PR-URL: https://github.com/nodejs/node/pull/21238 Reviewed-By:
-
Rich Trott authored
The CODEOWNERS file is not working out. It is not pinging any groups other than TSC (and more-or-less can't), and it pings TSC mostly for all the wrong things. It was a valiant effort, and possible worth revisiting at a future date when functionality is closer to what we need. But for now, let us bid it adieu. PR-URL: https://github.com/nodejs/node/pull/21161 Reviewed-By:
Myles Borins <myles.borins@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Ali Ijaz Sheikh <ofrobots@google.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Ujjwal Sharma <usharma1998@gmail.com>
-
Rich Trott authored
Provide more concise explanations of the deprecation levels in COLLABORATOR_GUIDE.md. PR-URL: https://github.com/nodejs/node/pull/21241 Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Yuta Hiroto <hello@hiroppy.me> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By:
Weijia Wang <starkwang@126.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
-
James M Snell authored
PR-URL: https://github.com/nodejs-private/node-private/pull/117 Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
Evan Lucas <evanlucas@me.com>
-
James M Snell authored
This fixes CVE-2018-1000168. PR-URL: https://github.com/nodejs-private/node-private/pull/117 Reviewed-By:
-
James M Snell authored
This fixes CVE-2018-7161. PR-URL: https://github.com/nodejs-private/node-private/pull/115 Reviewed-By:
-
Anna Henningsen authored
This would otherwise keep a lot of unused memory lying around, and in particular add up to a page per chunk of memory overhead for network reads, potentially opening a DoS vector if the resulting `Buffer` objects are kept around indefinitely (e.g. stored in a list and not concatenated until the socket finishes). This fixes CVE-2018-7164. Refs: https://github.com/nodejs-private/security/issues/186 Refs: https://github.com/nodejs/node/commit/7c4b09b24bbe7d6a8cbad256f47b30a101a909ea PR-URL: https://github.com/nodejs-private/node-private/pull/128 Reviewed-By:
-
Shigeki Ohtsu authored
Add a mock TLS socket implementation and a regression test for the previous commit. Refs: https://github.com/nodejs-private/security/issues/189 PR-URL: https://github.com/nodejs-private/node-private/pull/127 Reviewed-By:
-
Anna Henningsen authored
Fix an use-after-free bug in the TLS implementation. If we return from `DoWrite()` with an early error, we should not be storing the `WriteWrap` object and complete it again at a later point, when it has already been freed (because of the write error). This issue was reported by Jordan Zebor at F5 Networks, who also helped with investigating this bug and coming up with a reproduction. This fixes CVE-2018-7162. Fixes: https://github.com/nodejs-private/security/issues/189 PR-URL: https://github.com/nodejs-private/node-private/pull/127 Reviewed-By:
-
Evan Lucas authored
Notable changes: * **Fixes memory exhaustion DoS** (CVE-2018-7164): Fixes a bug introduced in 9.7.0 that increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. * **http2** * (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup * (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0 * **tls** (CVE-2018-7162): Fixes Denial of Service vulnerability by updating the TLS implementation to not crash upon receiving * **n-api**: Prevent use-after-free in napi_delete_async_work PR-URL: https://github.com/nodejs-private/node-private/pull/136 -
Evan Lucas authored
Notable changes: * **Fixes memory exhaustion DoS** (CVE-2018-7164): Fixes a bug introduced in 9.7.0 that increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. * **buffer** (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang * **http2** * (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup * (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0 * **tls** (CVE-2018-7162): Fixes Denial of Service vulnerability by updating the TLS implementation to not crash upon receiving PR-URL: https://github.com/nodejs-private/node-private/pull/135 -
Evan Lucas authored
Notable changes: * **buffer** (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang * **http2** * (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the http2 implementation to not crash under certain circumstances during cleanup * (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading nghttp2 to 1.32.0 PR-URL: https://github.com/nodejs-private/node-private/pull/126 -
Evan Lucas authored
Notable changes: * **buffer** (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang PR-URL: https://github.com/nodejs-private/node-private/pull/134
-
- Jun 12, 2018
-
-
Jeremiah Senkpiel authored
This was previously incorrect. PR-URL: https://github.com/nodejs/node/pull/21180 Reviewed-By:
Minwoo Jung <minwoo@nodesource.com> Reviewed-By:
-
Jeremiah Senkpiel authored
This functionality works but was previously untested. PR-URL: https://github.com/nodejs/node/pull/21180 Reviewed-By:
-
Rich Trott authored
Mark test-inspector-port-zero-cluster flaky on Linux. Also, alphabetize win32 entries in status file. PR-URL: https://github.com/nodejs/node/pull/21251 Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
-
Richard Lau authored
Run `make lint-md-build` to install the markdown linter. PR-URL: https://github.com/nodejs/node/pull/21215 Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
-
Evan Lucas authored
This reverts commit c2c9c0c3. It seems to be causing hangs when piping output to other processes. PR-URL: https://github.com/nodejs/node/pull/21257 Reviewed-By:
-
Anna Henningsen authored
Otherwise, closing all handles associated with the main event loop would also mean that `uv_tty_reset_mode()` can’t function properly because the corresponding FDs have already been closed. Fixes: https://github.com/nodejs/node/issues/21020 PR-URL: https://github.com/nodejs/node/pull/21257 Reviewed-By:
-
Anna Henningsen authored
Use a JS script to build addons rather than a shell command embedded in the Makefile, because parallelizing is hard in sh and easy in JS. PR-URL: https://github.com/nodejs/node/pull/21155 Reviewed-By:
-
Shelley Vohr authored
PR-URL: https://github.com/nodejs/node/pull/21187 Reviewed-By:
-
Anatoli Papirovski authored
PR-URL: https://github.com/nodejs/node/pull/21194 Reviewed-By:
-
Anatoli Papirovski authored
It's hypothetically (and with certain V8 flags) possible for the session to be garbage collected before all the streams are. In that case, trying to remove the stream from the session will lead to a segfault due to attempting to access no longer valid memory. Fix this by unsetting the session on any streams still around when destroying. PR-URL: https://github.com/nodejs/node/pull/21194 Reviewed-By:
-
- Jun 11, 2018
-
-
Daniel Bevenius authored
This commit adds a crypto check to test-http2-debug.js as it currently will error if configured --without-ssl. The issue here is that the while the test spawns a child process that runs test-http2-ping.js, which does have a crypto check, it will just print '1..0 # Skipped: missing crypto' to stdout, and nothing to stderr which is what this test is trying to assert and hence failing. PR-URL: https://github.com/nodejs/node/pull/21205 Reviewed-By:
Daijiro Wachi <daijiro.wachi@gmail.com> Reviewed-By:
-
Mark S. Everitt authored
Fixes: https://github.com/nodejs/node/issues/21202 PR-URL: https://github.com/nodejs/node/pull/21214 Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
-
James Kylstra authored
In test/parallel/test-intl.js, five calls to assert.strictEqual() use a third, string-literal parameter, which specifies a message to display when the assertion fails. The problem is that if the assertion fails, the error message will show the string literal but not the values that caused the assertion to fail. This commit removes the third parameter from the five calls and makes them comments above the assertions instead. The default error message produced by assert.strictEqual() shows the values that caused the assertion to fail, which should be somewhat more helpful. PR-URL: https://github.com/nodejs/node/pull/21211 Reviewed-By:
-
Rich Trott authored
test-inspector-stress-http launches 100 simultaneous http requests. It is unreliable in the parallel directory (as can be seen with tools/test.py and sufficiently high -j and --repeat values). Move to sequential. PR-URL: https://github.com/nodejs/node/pull/21227 Reviewed-By:
Jon Moss <me@jonathanmoss.me> Reviewed-By:
-
Nikolai Vavilov authored
PR-URL: https://github.com/nodejs/node/pull/21237 Reviewed-By:
-
- Jun 10, 2018
-
-
Michaël Zasso authored
Refs: https://github.com/v8/v8/compare/6.7.288.44...6.7.288.45 PR-URL: https://github.com/nodejs/node/pull/21192 Reviewed-By:
-
Rich Trott authored
This small change makes addon test build successfully with LLVM 10.0.0 and above. This will be fixed in npm source when node-gyp is updated to 3.6.3 or above. PR-URL: https://github.com/nodejs/node/pull/21239 Reviewed-By:
-
Anatoli Papirovski authored
PR-URL: https://github.com/nodejs/node/pull/21093 Fixes: https://github.com/nodejs/node/issues/18190 Refs: https://github.com/nodejs/node/pull/18307 Reviewed-By:
Jeremiah Senkpiel <fishrock123@rocketmail.com> Reviewed-By:
-
