- Mar 04, 2016
-
-
Michaël Zasso authored
PR-URL: https://github.com/nodejs/node/pull/4722 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Ali Ijaz Sheikh <ofrobots@google.com>
-
Michaël Zasso authored
PR-URL: https://github.com/nodejs/node/pull/4722 Reviewed-By:
-
Ali Ijaz Sheikh authored
PR-URL: https://github.com/nodejs/node/pull/4722 Reviewed-By:
Michaël Zasso <mic.besace@gmail.com>
-
Ali Ijaz Sheikh authored
Proxies support is now complete in V8. The tests needed slight modification to match the spec implementation. PR-URL: https://github.com/nodejs/node/pull/4722 Reviewed-By:
-
Michaël Zasso authored
- An error message changed for undefined references - `let` is now allowed in sloppy mode - ES2015 proxies are shipped and the `Proxy` global is now a function PR-URL: https://github.com/nodejs/node/pull/4722 Reviewed-By:
-
Ali Ijaz Sheikh authored
PR-URL: https://github.com/nodejs/node/pull/4722 Reviewed-By:
-
Ali Ijaz Sheikh authored
PR-URL: https://github.com/nodejs/node/pull/4722 Reviewed-By:
-
Ali Ijaz Sheikh authored
Pick up the current branch head for V8 4.9 https://github.com/v8/v8/commit/1ecba0f PR-URL: https://github.com/nodejs/node/pull/4722 Reviewed-By:
-
Rod Vagg authored
Notable changes: * http_parser: Update to http-parser 1.2 to fix an unintentionally strict limitation of allowable header characters. (James M Snell) https://github.com/nodejs/node/pull/5242 * domains: - Prevent an exit due to an exception being thrown rather than emitting an 'uncaughtException' event on the `process` object when no error handler is set on the domain within which an error is thrown and an 'uncaughtException' event listener is set on `process`. (Julien Gilli) https://github.com/nodejs/node/pull/3887 - Fix an issue where the process would not abort in the proper function call if an error is thrown within a domain with no error handler and `--abort-on-uncaught-exception` is used. (Julien Gilli) https://github.com/nodejs/node/pull/3887 * openssl: Upgrade from 1.0.1r to 1.0.1s (Ben Noordhuis) https://github.com/nodejs/node/pull/5508 - Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0705 - Fix a defect that can cause memory corruption in certain very rare cases relating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are _unlikely_ to be possible. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0797 - Fix a defect that makes the CacheBleed Attack (https://ssrg.nicta.com.au/projects/TS/cachebleed/) possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0702 - Remove SSLv2 support, the `--enable-ssl2` command line argument will now produce an error. The DROWN Attack (https://drownattack.com/) creates a vulnerability where SSLv2 is enabled by a server, even if a client connection is not using SSLv2. The SSLv2 protocol is widely considered unacceptably broken and should not be supported. More information is available at https://www.openssl.org/news/vulnerabilities.html#2016-0800 PR-URL: https://github.com/nodejs/node/pull/5404
-
Rod Vagg authored
Notable changes: * http_parser: Update to http-parser 2.3.2 to fix an unintentionally strict limitation of allowable header characters. (James M Snell) https://github.com/nodejs/node/pull/5241 * domains: - Prevent an exit due to an exception being thrown rather than emitting an 'uncaughtException' event on the `process` object when no error handler is set on the domain within which an error is thrown and an 'uncaughtException' event listener is set on `process`. (Julien Gilli) https://github.com/nodejs/node/pull/3885 - Fix an issue where the process would not abort in the proper function call if an error is thrown within a domain with no error handler and `--abort-on-uncaught-exception` is used. (Julien Gilli) https://github.com/nodejs/node/pull/3885 * openssl: Upgrade from 1.0.2f to 1.0.2g (Ben Noordhuis) https://github.com/nodejs/node/pull/5509 - Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0705 - Fix a defect that can cause memory corruption in certain very rare cases relating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are _unlikely_ to be possible. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0797 - Fix a defect that makes the CacheBleed Attack (https://ssrg.nicta.com.au/projects/TS/cachebleed/) possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0702 PR-URL: https://github.com/nodejs/node/pull/5403
-
James M Snell authored
Rework the doc a bit to tighten it up, including removing the use of `you` Fix some line wrapping issues. PR-URL: https://github.com/nodejs/node/pull/5287 Reviewed-By:
Roman Klauke <romaaan.git@gmail.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com> ...
-
Trevor Norris authored
Looping rapidly and making new connections causes problems on pi2. Instead create a new connection when an old connection has already been made. Running a stress test of 600 times and they all passed. Fixes: https://github.com/nodejs/node/issues/5302 PR-URL: https://github.com/nodejs/node/pull/5537 Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Alexis Campailla <orangemocha@nodejs.org>
-
Wyatt Preul authored
The properties on memoryUsage were not checked before, this commit checks them. PR-URL: #5546 Reviewed-By: -
silverwind authored
Also fixed a minor color issue with :focus on the title. PR-URL: https://github.com/nodejs/node/pull/5548 Reviewed-By:
-
Rich Trott authored
PR-URL: https://github.com/nodejs/node/pull/5517 Reviewed-By:
Brian White <mscdex@mscdex.net> Reviewed-By:
Evan Lucas <evanlucas@me.com> Reviewed-By:
James M Snell <jasnell@gmail.com>
-
Rich Trott authored
PR-URL: https://github.com/nodejs/node/pull/5517 Reviewed-By:
-
Rich Trott authored
Enable `no-extra-parens`. This rule restricts the use of parentheses to only where they are necessary. It is set to be restricted to report only function expressions. PR-URL: https://github.com/nodejs/node/pull/5512 Reviewed-By:
-
- Mar 03, 2016
-
-
Jeremiah Senkpiel authored
Notable changes: * governance: The Core Technical Committee (CTC) added four new members to help guide Node.js core development: Evan Lucas, Rich Trott, Ali Ijaz Sheikh and Сковорода Никита Андреевич (Nikita Skovoroda). * openssl: Upgrade from 1.0.2f to 1.0.2g (Ben Noordhuis) https://github.com/nodejs/node/pull/5507 - Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0705 - Fix a defect that can cause memory corruption in certain very rare cases relating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are _unlikely_ to be possible. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0797 - Fix a defect that makes the CacheBleed Attack (https://ssrg.nicta.com.au/projects/TS/cachebleed/) possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at https://www.openssl.org/news/vulnerabilities.html#2016-0702 * Fixed several regressions that appeared in v5.7.0: - path.relative(): - Output is no longer unnecessarily verbose (Brian White) https://github.com/nodejs/node/pull/5389 - Resolving UNC paths on Windows now works correctly (Owen Smith) https://github.com/nodejs/node/pull/5456 - Resolving paths with prefixes now works correctly from the root directory (Owen Smith) https://github.com/nodejs/node/pull/5490 - url: Fixed an off-by-one error with `parse()` (Brian White) https://github.com/nodejs/node/pull/5394 - dgram: Now correctly handles a default address case when offset and length are specified (Matteo Collina) https://github.com/nodejs/node/pull/5407 PR-URL: https://github.com/nodejs/node/pull/5464
-
Craig Akimoto authored
https://code.google.com/p/v8/ redirects to the V8 issue tracker PR-URL: https://github.com/nodejs/node/pull/5530 Reviewed-By:
-
Myles Borins authored
This is a security release with only a single commit, an update to openssl due to a recent security advisory. You can read more about the security advisory on the Node.js website https://nodejs.org/en/blog/vulnerability/openssl-march-2016/ * openssl: Upgrade from 1.0.2f to 1.0.2g (Ben Noordhuis) https://github.com/nodejs/node/pull/5507 - Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at CVE-2016-0705 https://www.openssl.org/news/vulnerabilities.html#2016-0705. - Fix a defect that can cause memory corruption in certain very rare cases relating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are _unlikely_ to be possible. More info is available at CVE-2016-0797 https://www.openssl.org/news/vulnerabilities.html#2016-0797. - Fix a defect that makes the _CacheBleed Atta https://ssrg.nicta.com.au/projects/TS/cachebleed/ _ possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at CVE-2016-0702 https://www.openssl.org/news/vulnerabilities.html#2016-0702. PR-URL: https://github.com/nodejs/node/pull/5526
-
Fedor Indutny authored
Do not treat crypto inputs as `binary` strings, convert them to Buffers using `new Buffer(..., 'utf8')`, or using newly updated StringBytes APIs. PR-URL: https://github.com/nodejs/node/pull/5522 Reviewed-By:
-
ronkorving authored
PR-URL: https://github.com/nodejs/node/pull/5472 Reviewed-By:
Roman Reiss <me@silverwind.io> Reviewed-By:
Сковорода Никита Андреевич <chalkerx@gmail.com> Reviewed-By:
-
firedfox authored
All eslint rules are configured to report as errors. Remove useless --quiet flag from eslint invocation in Makefile and vcbuild.bat. PR-URL: https://github.com/nodejs/node/pull/5519 Reviewed-By:
Johan Bergström <bugs@bergstroem.nu> Reviewed-By:
-
Anton Khlynovskiy authored
Array#pop() is known to be faster than Array#shift(). To be exact, it's O(1) vs. O(n). In this case there's no difference from which side of the "pool" array the object is retrieved, so .pop() should be preferred. PR-URL: https://github.com/nodejs/node/pull/2174 Reviewed-By:
-
Rod Vagg authored
PR-URL: https://github.com/nodejs/node/pull/5410 Reviewed-By:
-
Ben Noordhuis authored
* Restrict the receiver to instances of the FunctionTemplate. * Use `args.This()` instead of `args.Holder()`. Fixes: https://github.com/nodejs/node/issues/3682 PR-URL: https://github.com/nodejs/node/pull/5521 Reviewed-By:
Fedor Indutny <fedor@indutny.com>
-
- Mar 02, 2016
-
-
Rich Trott authored
Increase timeout for test from 500ms to 1000ms so busy slow machines don't produce false positives. Fixes: https://github.com/nodejs/node/issues/4964 PR-URL: https://github.com/nodejs/node/pull/5466 Reviewed-By:
-
Rich Trott authored
Do not try Ubuntu/SUSE/Debian-specific hostnames for IPv6 localhost unless we are on Linux. Fixes: https://github.com/nodejs/node/issues/4546 PR-URL: https://github.com/nodejs/node/pull/5471 Reviewed-By:
Jeremiah Senkpiel <fishrock123@rocketmail.com>
-
Michael Dawson authored
Allow extra options when testing v8 in Node tree PR-URL: https://github.com/nodejs/node/pull/5502 Reviewed-By:
-
Rich Trott authored
Have `make test` run linting tools before tests rather than after. Lint is likely to find issues quickly. Tests may take a while to run. So do the linting first. Refs: https://github.com/nodejs/node/issues/4546#issuecomment-189755007 PR-URL: https://github.com/nodejs/node/pull/5470 Reviewed-By:
Myles Borins <myles.borins@gmail.com> Reviewed-By:
-
Rich Trott authored
In order to comply with linting rules used in the rest of the code base, eliminate redeclared variables. A conservative approach is used so as to avoid unintentional performance issues (for example, as might be seen in some situations when using `let` instead of `var`). PR-URL: https://github.com/nodejs/node/pull/5468 Reviewed-By:
-
Rich Trott authored
There is a known issue with SmartOS that is generally worked around in `tools/test.py`. However, a more robust workaround is required for some tests that open many network connections. `test-http-regr-gh-2928` is one such test. Fixes: https://github.com/nodejs/node/issues/5445 Refs: https://github.com/nodejs/node/pull/3941 PR-URL: https://github.com/nodejs/node/pull/5454 Reviewed-By:
-
Ben Noordhuis authored
PR-URL: https://github.com/nodejs/node/pull/5507 Reviewed-By:
-
- Mar 01, 2016
-
-
Trevor Norris authored
Make `HTTPParser` an instance of `AsyncWrap` and make it use `MakeCallback`. This means that async wrap hooks will be called on consumed TCP sockets as well as on non-consumed ones. Additional uses of `AsyncCallbackScope` are necessary to prevent improper state from progressing that triggers failure in the test-http-pipeline-flood.js test. Optimally this wouldn't be necessary, but for the time being it's the most sure way to allow operations to proceed as they have. Fix: https://github.com/nodejs/node/issues/4416 PR-URL: https://github.com/nodejs/node/pull/5419 Reviewed-By:
-
Fedor Indutny authored
Change types of all PBKDF2 params to `int` as they are `int` in `evp.h`. Check that `raw_keylen` fits into `int` before passing it to OpenSSL. Fix: #5396 PR-URL: https://github.com/nodejs/node/pull/5397 Reviewed-By:
Shigeki Ohtsu <ohtsu@iij.ad.jp> Reviewed-By:
-
nettofarah authored
Reorder slashed protocols so they are grouped by protocol name. This is done so it doesn't look like we're duplicating protocol names at the bottom of the list. PR-URL: https://github.com/nodejs/node/pull/5380 Reviewed-By:
-
Aayush Naik authored
As mentioned in the comment of the changed file, "a libuv limitation makes it necessary to bind()". But, that is not the case in this test. The subsequent call to send() results in an implicit bind(). PR-URL: https://github.com/nodejs/node/pull/5023 Reviewed-By:
Saúl Ibarra Corretgé <saghul@gmail.com>
-
Santiago Gimeno authored
The test is still failing sometimes because when trying to establish the second connection, the server is already closed. Bring back the code that handled this case and was removed in the last refactoring of the test. Also ignore the errors that might happen when sending the second handle to the worker because it may already have exited. PR-URL: https://github.com/nodejs/node/pull/5422 Reviewed-By:
-
Owen Smith authored
Fixes #5485 PR-URL: https://github.com/nodejs/node/pull/5490 Reviewed-By:
-
Rich Trott authored
`test-tls-ticket-cluster` and `test-vm-syntax-error-stderr` are no longer flaky. Refs: https://github.com/nodejs/node/issues/2510 Refs: https://github.com/nodejs/node/issues/2660 PR-URL: https://github.com/nodejs/node/pull/5459 Reviewed-By:
-
