- Feb 08, 2020
-
-
Rich Trott authored
process.emitWarning() "now" option is undocumented and a Boolean trap. Remove it before people start adopting it. We only need it in one place internally. Replace it with an internal-only emitWarningSync() function. PR-URL: https://github.com/nodejs/node/pull/31643 Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
Myles Borins <myles.borins@gmail.com>
-
Anna Henningsen authored
It looks like it’s virtually impossible at this point to create “fake” backing stores for objects that don’t fully own their memory allocations, like the sub-field `js_fields_` of `Http2Session`. In particular, it turns out that an `ArrayBuffer` cannot always be easily separated from its backing store in that situation through by detaching it. This commit gives the JS-exposed parts of the class its own memory allocation and its own backing store, simplifying the code a bit and fixing flakiness coming from it, at the cost of one additional layer of indirection when accessing the data. Refs: https://github.com/nodejs/node/pull/30782 Fixes: https://github.com/nodejs/node/issues/31107 PR-URL: https://github.com/nodejs/node/pull/31648 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Denys Otrishko <shishugi@gmail.com>
-
Ben Noordhuis authored
Remove the version of GetHumanReadableProcessName() that operates on a fixed-size buffer. The only remaining caller is Assert() which might get called in contexts where dynamically allocating memory isn't possible but as Assert() calls printf(), which also allocates memory when necessary, this commit is unlikely to make matters much worse. PR-URL: https://github.com/nodejs/node/pull/31633 Fixes: https://github.com/nodejs/node/issues/31631 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
David Carlier <devnexen@gmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com>
-
Ben Noordhuis authored
The getter passed a stack-allocated, fixed-size buffer to uv_get_process_title() but neglected to check the return value. When the total length of the command line arguments exceeds the size of the buffer, libuv returns UV_ENOBUFS and doesn't modify the contents of the buffer. The getter then proceeded to return whatever garbage was on the stack at the time of the call, quite possibly reading beyond the end of the buffer. Add a GetProcessTitle() helper that reads the process title into a dynamically allocated buffer that is resized when necessary. Fixes: https://github.com/nodejs/node/issues/31631 PR-URL: https://github.com/nodejs/node/pull/31633 Reviewed-By:
-
Anna Henningsen authored
Motivated by the fact that getting this wrong has led to flaky tests in our test suite. Refs: https://github.com/nodejs/node/pull/31637 PR-URL: https://github.com/nodejs/node/pull/31642 Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
-
James M Snell authored
Went hunting for possible performance improvements. Didn't find anything significant but did manage to make a number of style improvements that bring more in line with style guidelines and good pratice. PR-URL: https://github.com/nodejs/node/pull/31651 Reviewed-By:
-
Tobias Nießen authored
PR-URL: https://github.com/nodejs/node/pull/31652 Reviewed-By:
Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
-
Anna Henningsen authored
Use a JS function as the single entry point for emitting `.onmessage()` calls, avoiding the overhead of manually constructing each message event object in C++. confidence improvement accuracy (*) (**) (***) worker/echo.js n=100000 sendsPerBroadcast=1 payload='object' workers=1 *** 16.34 % ±1.16% ±1.54% ±1.99% worker/echo.js n=100000 sendsPerBroadcast=1 payload='string' workers=1 *** 24.41 % ±1.50% ±1.99% ±2.58% worker/echo.js n=100000 sendsPerBroadcast=10 payload='object' workers=1 *** 26.66 % ±1.54% ±2.05% ±2.65% worker/echo.js n=100000 sendsPerBroadcast=10 payload='string' workers=1 *** 32.72 % ±1.60% ±2.11% ±2.73% worker/messageport.js n=1000000 payload='object' *** 40.28 % ±1.48% ±1.95% ±2.52% worker/messageport.js n=1000000 payload='string' *** 76.95 % ±2.19% ±2.90% ±3.75% Also fix handling exceptions returned from `MessagePort::New`. PR-URL: https://github.com/nodejs/node/pull/31605 Reviewed-By: -
Joyee Cheung authored
This removes the obsolete issue template file since we already have the issue template folder which is the one currently in effect. PR-URL: https://github.com/nodejs/node/pull/31656 Refs: https://github.com/nodejs/node/pull/31611 Reviewed-By:
-
Swagat Konchada authored
Fixes: https://github.com/nodejs/node/issues/28675 PR-URL: https://github.com/nodejs/node/pull/31542 Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
-
- Feb 07, 2020
-
-
Ruben Bridgewater authored
This adds the `tabSize` option to readline to allow different tab sizes. PR-URL: https://github.com/nodejs/node/pull/31318 Reviewed-By:
Anto Aravinth <anto.aravinth.cse@gmail.com> Reviewed-By:
-
tsabolov authored
`ArrayBuffer` instances do not have `.length` property. Instead they have `.byteLength` property. Fixed that in the description of `new Buffer(arrayBuffer[, byteOffset[, length]])` and `Buffer.from(arrayBuffer[, byteOffset[, length]])`. PR-URL: https://github.com/nodejs/node/pull/31632 Reviewed-By:
Yongsheng Zhang <zyszys98@gmail.com> Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
-
Rich Trott authored
This adds covereage for the onlookupservice() callback in lib/internal/dns/promises.js. Because of stubbing in other tests, it is not currently covered. This test works on my local development machine with the network turned off, so I'm putting it in parallel. If CI proves more challenging, it can be moved to the internet directory instead. PR-URL: https://github.com/nodejs/node/pull/31640 Reviewed-By:
-
Richard Lau authored
Refactor `tools/make-v8.sh` to minimise differences between the `ppc64le` and `s390x` paths to allow us to enable `ccache` on the `ppc64le` machines in the CI. PR-URL: https://github.com/nodejs/node/pull/31628 Refs: https://github.com/nodejs/build/pull/1927 Refs: https://github.com/nodejs/build/issues/1940 Reviewed-By:
Sam Roberts <vieuxtech@gmail.com>
-
Gabriel Schulhof authored
Instance data associated with a `napi_env` is no longer stored on the env itself but is instead rendered as a reference. Since `v8impl::Reference` is tied to a JS object, this modification factors out the `v8impl::Reference` refcounting and the deletion process into a base class for `v8impl::Reference`, called `v8impl::RefBase`. The instance data is then stored as a `v8impl::RefBase`, along with other references, preventing a segfault that arises from the fact that, up until now, upon `napi_env` destruction, the instance data was freed after all references had already been forcefully freed. If the addon freed a reference during the `napi_set_instance_data` finalizer callback, such a reference had already been freed during environment teardown, causing a double free. Re: https://github.com/nodejs/node-addon-api/pull/663 PR-URL: https://github.com/nodejs/node/pull/31638 Reviewed-By:
-
Rich Trott authored
Rename "strict mode" in the assert module to "strict assertion mode". This is to avoid confusion with the more typical meaning of "strict mode" in ECMAScript. This necessitates a corresponding change of "legacy mode" to "legacy assertion mode". PR-URL: https://github.com/nodejs/node/pull/31635 Reviewed-By:
-
- Feb 06, 2020
-
-
Sam Roberts authored
See: https://hackerone.com/reports/735748 PR-URL: https://github.com/nodejs-private/node-private/pull/199 Reviewed-By:
-
Beth Griggs authored
PR-URL: https://github.com/nodejs-private/node-private/pull/199 Reviewed-By:
-
Fedor Indutny authored
`X509V3_EXT_print` can return value different from `1` if the X509 extension does not support printing to a buffer. Instead of failing with an unrecoverable assertion - replace the relevant value in the hashmap with a JS null value. Fixes: https://hackerone.com/reports/746733 PR-URL: https://github.com/nodejs-private/node-private/pull/175 Reviewed-By:
Sam <Roberts <vieuxtech@gmail.com> Reviewed-By:
Matteo <Collina <matteo.collina@gmail.com> Reviewed-By:
Ben <Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Rich <Trott <rtrott@gmail.com> Reviewed-By:
Anna <Henningsen <anna@addaleax.net> Reviewed-By:
Shelley <Vohr <codebytere@gmail.com> Reviewed-By:
Tobias <Nießen <tniessen@tnie.de> Reviewed-By:
Gireesh <Punathil <gpunathi@in.ibm.com> Reviewed-By:
Beth <Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By:
Michael <Dawson <michael_dawson@ca.ibm.com>
-
Sam Roberts authored
HTTP header values can have trailing OWS, but it should be stripped. It is not semantically part of the header's value, and if treated as part of the value, it can cause spurious inequality between expected and actual header values. Note that a single SPC of leading OWS is common before the field-value, and it is already handled by the HTTP parser by stripping all leading OWS. It is only the trailing OWS that must be stripped by the parser user. header-field = field-name ":" OWS field-value OWS ; https://tools.ietf.org/html/rfc7230#section-3.2 OWS = *( SP / HTAB ) ; https://tools.ietf.org/html/rfc7230#section-3.2.3 Fixes: https://hackerone.com/reports/730779 PR-URL: https://github.com/nodejs-private/node-private/pull/189 Reviewed-By:
Fedor <Indutny <fedor.indutny@gmail.com> Reviewed-By:
James M <Snell <jasnell@gmail.com>
-
Sam Roberts authored
wrk did not support sending optional headers, they were silently ignored. This appears to be an oversight, they were supported for autocannon. PR-URL: https://github.com/nodejs-private/node-private/pull/189 Reviewed-By:
-
Anna Henningsen authored
Alternative to https://github.com/nodejs/node/pull/31590. It appears that the issue here is that the test falsely assumed that closing the client (which also currently destroys the socket rather than gracefully shutting down the connection) would still leave enough time for the server side to receive the stream error. Address that by explicitly waiting for the server side to receive the stream error before closing the client and the connection with it. Refs: https://github.com/nodejs/node/pull/31590 Refs: https://github.com/nodejs/node/issues/20750 PR-URL: https://github.com/nodejs/node/pull/31610 Reviewed-By:
-
James M Snell authored
Add missing `-` characters in the list. PR-URL: https://github.com/nodejs/node/pull/31655 Reviewed-By:
Yuta Hiroto <hello@hiroppy.me> Reviewed-By:
-
Beth Griggs authored
This is a security release. Vulnerabilities fixed: * **CVE-2019-15606**: HTTP header values do not have trailing OWS trimmed. * **CVE-2019-15605**: HTTP request smuggling using malformed Transfer-Encoding header. * **CVE-2019-15604**: Remotely trigger an assertion on a TLS server with a malformed certificate string. Also, HTTP parsing is more strict to be more secure. Since this may cause problems in interoperability with some non-conformant HTTP implementations, it is possible to disable the strict checks with the `--insecure-http-parser` command line flag, or the `insecureHTTPParser` http option. Using the insecure HTTP parser should be avoided. PR-URL: https://github.com/nodejs-private/node-private/pull/198 -
Beth Griggs authored
This is a security release. Vulnerabilities fixed: * **CVE-2019-15606**: HTTP header values do not have trailing OWS trimmed. * **CVE-2019-15605**: HTTP request smuggling using malformed Transfer-Encoding header. * **CVE-2019-15604**: Remotely trigger an assertion on a TLS server with a malformed certificate string. Also, HTTP parsing is more strict to be more secure. Since this may cause problems in interoperability with some non-conformant HTTP implementations, it is possible to disable the strict checks with the `--insecure-http-parser` command line flag, or the `insecureHTTPParser` http option. Using the insecure HTTP parser should be avoided. PR-URL: https://github.com/nodejs-private/node-private/pull/197 -
Beth Griggs authored
This is a security release. Vulnerabilities fixed: * **CVE-2019-15606**: HTTP header values do not have trailing OWS trimmed. * **CVE-2019-15605**: HTTP request smuggling using malformed Transfer-Encoding header. * **CVE-2019-15604**: Remotely trigger an assertion on a TLS server with a malformed certificate string. Also, HTTP parsing is more strict to be more secure. Since this may cause problems in interoperability with some non-conformant HTTP implementations, it is possible to disable the strict checks with the `--insecure-http-parser` command line flag, or the `insecureHTTPParser` http option. Using the insecure HTTP parser should be avoided. PR-URL: https://github.com/nodejs-private/node-private/pull/196 -
Joyee Cheung authored
Inspired by the defect report template of the V8 issue tracker PR-URL: https://github.com/nodejs/node/pull/31611 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Weijia Wang <starkwang@126.com> Reviewed-By:
Daijiro Wachi <daijiro.wachi@gmail.com> Reviewed-By:
Tobias Nießen <tniessen@tnie.de>
-
James M Snell authored
The tmpDir alias was deprecated in 7.0.0 PR-URL: https://github.com/nodejs/node/pull/31169 Reviewed-By:
-
James M Snell authored
GLOBAL and root have been long deprecated. PR-URL: https://github.com/nodejs/node/pull/31167 Reviewed-By:
Jiawen Geng <technicalcute@gmail.com> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
-
James M Snell authored
API has been being incrementally deprecated since 6.0.0 PR-URL: https://github.com/nodejs/node/pull/31166 Reviewed-By:
-
James M Snell authored
API was deprecated back in the 0.11 days. PR-URL: https://github.com/nodejs/node/pull/31165 Reviewed-By:
Robert Nagy <ronagy@icloud.com>
-
- Feb 05, 2020
-
-
Conor ONeill authored
PR-URL: https://github.com/nodejs/node/pull/31552 Reviewed-By:
-
Anna Henningsen authored
During the `init()` async hook, the C++ object is not finished creating yet (i.e. it is an `AsyncWrap`, but not yet a `HandleWrap` or `MessagePort`). Accessing the `handle_` field is not valid in that case. However, the custom inspect function for `MessagePort`s calls `HasRef()` on the object, which would crash when the object is not fully constructed. Fix that by guarding the access of the libuv handle on that condition. PR-URL: https://github.com/nodejs/node/pull/31600 Reviewed-By:
-
Robert Nagy authored
Emitting 'close' before 'finish' on a Writable should result in a premature close error. PR-URL: https://github.com/nodejs/node/pull/31534 Reviewed-By:
-
Anna Henningsen authored
Use Worker thread pools as an example of how `AsyncResource` can be used to track async state across callbacks. PR-URL: https://github.com/nodejs/node/pull/31601 Reviewed-By:
Chengzhong Wu <legendecas@gmail.com> Reviewed-By:
-
Ruben Bridgewater authored
PR-URL: https://github.com/nodejs/node/pull/31423 Reviewed-By:
-
Ruben Bridgewater authored
This reduces the code lines required to run the tests by abstracting the constructor call. It also moves tests out of a for loop that where miss placed. PR-URL: https://github.com/nodejs/node/pull/31423 Reviewed-By:
-
Juan José Arboleda authored
PR-URL: https://github.com/nodejs/node/pull/31030 Reviewed-By:
-
Ruben Bridgewater authored
The input was not validated so far and that caused unwanted side effects. E.g., `undefined` became the string `'undefined'`. It was expected to fail or to end up as empty string. Now all input is validated to be either some type of array buffer view or a string. That way it's always clear what the user intents. PR-URL: https://github.com/nodejs/node/pull/31030 Fixes: https://github.com/nodejs/node/issues/31025 Reviewed-By:
-
James M Snell authored
Closing the FileHandle on garbage collection is a bad practice. Runtime deprecate and indicate that an error will be thrown in the future. PR-URL: https://github.com/nodejs/node/pull/28396 Reviewed-By:
-
