- Sep 29, 2016
-
-
Luigi Pinca authored
Specify that commit subject line must be made of only lowercase words and should start with an imperative verb. PR-URL: https://github.com/nodejs/node/pull/8546 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Jeremiah Senkpiel <fishrock123@rocketmail.com>
-
Rich Trott authored
In the onboarding document, add a note to ask the new Collaborator if they are using two-factor authentication on their GitHub account. If they are not, suggest that they enable it as their account will have elevated privileges in many of the Node.js repositories. PR-URL: https://github.com/nodejs/node/pull/8776 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Ilkka Myller <ilkka.myller@nodefield.com> Reviewed-By:
Сковорода Никита Андреевич <chalkerx@gmail.com> Reviewed-By:
Johan Bergstrom <bugs@bergstroem.nu> Reviewed-By:
Robert Jefe Lindstaedt <robert.lindstaedt@gmail.com> Reviewed-By:
Myles Borins <myles.borins@gmail.com> Reviewed-By:
-
Rich Trott authored
Include information on how to force push to the contributor's own branch so that pull requests show as merged in GitHub interface. PR-URL: https://github.com/nodejs/node/pull/8774 Reviewed-By:
-
Richard Hong authored
replace indexOf with includes replace assert.equal with assert.strictEqual add common.mustCall replace throw error with assert.ifError PR-URL: https://github.com/nodejs/node/pull/8766 Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
-
Christopher Fujino authored
Updated BUILDING.md, removing workaround for Python conflicts that didn't work. PR-URL: https://github.com/nodejs/node/pull/8763 Reviewed-By:
Bryan English <bryan@bryanenglish.com> Reviewed-By:
-
- Sep 28, 2016
-
-
Ben Noordhuis authored
Rename CHECK_NOT_OOB() to THROW_AND_RETURN_IF_OOB() because the old name suggests it asserts and aborts when it is really a control flow macro. PR-URL: https://github.com/nodejs/node/pull/8784 Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
-
Сковорода Никита Андреевич authored
This makes sure that no uninitialized bytes are leaked when the specified `totalLength` input value is greater than the actual total length of the specified buffers array, e.g. in Buffer.concat([Buffer.alloc(0)], 100). PR-URL: https://github.com/nodejs/node-private/pull/64 Reviewed-By:
Rod Vagg <rod@vagg.org> Reviewed-By:
-
Ben Noordhuis authored
PR-URL: https://github.com/nodejs/node-private/pull/75 Reviewed-By:
Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By:
-
Ben Noordhuis authored
Compile out hardware engines. Most are stubs that dynamically load the real driver but that poses a security liability when an attacker is able to create a malicious DLL in one of the default search paths. PR-URL: https://github.com/nodejs/node-private/pull/73 Reviewed-By:
-
Evan Lucas authored
Previously, the reason argument passed to ServerResponse#writeHead was not being properly validated. One could pass CRLFs which could lead to http response splitting. This commit changes the behavior to throw an error in the event any invalid characters are included in the reason. CVE-2016-5325 PR-URL: https://github.com/nodejs/node-private/pull/60 Reviewed-By:
-
yorkie authored
- this shares the iterator variable `i` expictly. - this converts some var to const. PR-URL: https://github.com/nodejs/node/pull/8781 Reviewed-By:
Brian White <mscdex@mscdex.net> Reviewed-By:
-
Evan Lucas authored
This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. Notable Changes Semver Minor: * openssl: - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306. (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8714 - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8786 - Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) h...
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. Notable Changes Semver Minor: * openssl: - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8714 - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8786 - Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) https://github.com/nodejs/node-private/pull/70 * http: CVE-2016-5325 - Properly validate for allowable characters in the `reason` argument in `ServerResponse#writeHead()`. Fixes a possible response splitting attack vector. This introduces a new case where `throw` may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) https://github.com/nodejs/node-private/pull/46 Semver Patch: * buffer: Zero-fill excess bytes in new `Buffer` objects created with `Buffer.concat()` while providing a `totalLength` parameter that exceeds the total length of the original `Buffer` objects being concatenated. (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/65 * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of `*.` in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) https://github.com/nodejs/node-private/pull/63 PR-URL: https://github.com/nodejs/node-private/pull/74
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. Notable changes: * buffer: Zero-fill excess bytes in new `Buffer` objects created with `Buffer.concat()` while providing a `totalLength` parameter that exceeds the total length of the original `Buffer` objects being concatenated. (Сковорода Никита Андреевич) * http: - CVE-2016-5325 - Properly validate for allowable characters in the `reason` argument in `ServerResponse#writeHead()`. Fixes a possible response splitting attack vector. This introduces a new case where `throw` may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) - Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999. Lack of proper validation may also serve as a potential response splitting attack vector. Backported from v4.x. (Brian White) * openssl: - Upgrade to 1.0.1u, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. - Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis, Rod Vagg) * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of `*.` in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) PR-URL: https://github.com/nodejs/node-private/pull/72
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. Notable changes: * buffer: Zero-fill excess bytes in new `Buffer` objects created with `Buffer.concat()` while providing a `totalLength` parameter that exceeds the total length of the original `Buffer` objects being concatenated. (Сковорода Никита Андреевич) * http: - CVE-2016-5325 - Properly validate for allowable characters in the `reason` argument in `ServerResponse#writeHead()`. Fixes a possible response splitting attack vector. This introduces a new case where `throw` may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) - Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999. Lack of proper validation may also serve as a potential response splitting attack vector. Backported from v4.x. (Brian White) * openssl: Upgrade to 1.0.1u, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-6303, CVE-2016-2178 and CVE-2016-6306. * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of `*.` in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) PR-URL: https://github.com/nodejs/node-private/pull/71
-
fen authored
this commit enhances the guidelines to creating a release blog post, specifically by adding a commit format that must be adhered to when creating a pull request on the website repository Fixes: https://github.com/nodejs/node/issues/8629 PR-URL: https://github.com/nodejs/node/pull/8631 Reviewed-By:
James M Snell <jasnell@keybase.io> Reviewed-By:
-
Kat Marchán authored
PR-URL: https://github.com/nodejs/node/pull/8706 Reviewed-By:
-
Kat Marchán authored
PR-URL: https://github.com/nodejs/node/pull/8706 Reviewed-By:
-
- Sep 27, 2016
-
-
yorkie authored
PR-URL: https://github.com/nodejs/node/pull/8782 Reviewed-By:
Teddy Katz <teddy.katz@gmail.com> Reviewed-By:
-
Marc-Aurèle DARCHE authored
crypto.timingSafeEqual() has been added in v6.6.0 cf. #8304 This commit adds the metadata that will display "Added in: v6.6.0" and that can later be checked on https://nodejs.org/api/crypto.html#crypto_crypto_timingsafeequal_a_b PR-URL: https://github.com/nodejs/node/pull/8796 Reviewed-By:
-
Сковорода Никита Андреевич authored
This renames doc/topics/the-event-loop-timers-and-nexttick.md to doc/topics/event-loop-timers-and-nexttick.md, which looks like a better name for that file and enables no-file-name-articles remark-lint rule to prevent such names in the future. PR-URL: https://github.com/nodejs/node/pull/8713 Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
-
Alfred Cepeda authored
When NODE_REPL_HISTORY isn't defined `repl` defaults to temporary file This prevents the temporary file from being cleared and removes check on fixture Refs: https://github.com/nodejs/node/issues/4640 PR-URL: https://github.com/nodejs/node/pull/8756 Reviewed-By:
-
Matt Lang authored
PR-URL: https://github.com/nodejs/node/pull/8595 Reviewed-By:
-
Сковорода Никита Андреевич authored
This makes sure that the first heading in all markdown files is h1. Only three files needed to be changed to conform: 1. BUILDING.md 2. CODE_OF_CONDUCT.md 3. doc/onboarding-extras.md Also, .remarkrc is updated to include the `first-heading-level: 1` rule in order to catch similar issues in the future. PR-URL: https://github.com/nodejs/node/pull/8716 Reviewed-By:
-
nohmapp authored
Changes var to const, != to !==, and assert.equal() to assert.strict Equal() PR-URL: https://github.com/nodejs/node/pull/8764 Reviewed-By:
-
Jenna Vuong authored
replace ==, !=, some instances of var, and assert.equal() PR-URL: https://github.com/nodejs/node/pull/8770 Reviewed-By:
-
mpmckenna8 authored
Replaced .indexOf() with .includes() for more clarity as to what it is doing. Many of the instances of var changed to const. Instances of assert.equal() refactored to assert.strictEqual() or assert.ifError() Removed the unlinkSync() call in the exit event handler because it probably only handles files in the testing tmp directory so there is no need to unlink them. PR-URL: https://github.com/nodejs/node/pull/8769 Reviewed-By:
-
Lydia Katsamberis authored
Changed var to const where appropriate. Substituted assert.strictEqual for assert.equal for better type checks. PR-URL: https://github.com/nodejs/node/pull/8762 Reviewed-By:
-
Lauren Spiegel authored
1) Add missing assertion that slicing a 0 length buffer does not throw 2) Add assertion that slicing a 0 length buffer has a length of 0 PR-URL: https://github.com/nodejs/node/pull/8729 Reviewed-By:
-
Anna Henningsen authored
Adds benchmarks for `Buffer.from()` and its various argument combinations. Ref: https://github.com/nodejs/node/issues/8733 PR-URL: https://github.com/nodejs/node/pull/8738 Reviewed-By:
-
Michaël Zasso authored
V8 5.4 changed the way that the default constructor of derived classes is called. It introduced a significant performance regression in the buffer module for the creation of pooled buffers. This commit forces the definition back to how it was implicitly before. Ref: https://bugs.chromium.org/p/v8/issues/detail?id=4890 PR-URL: https://github.com/nodejs/node/pull/8754 Reviewed-By:
Trevor Norris <trev.norris@gmail.com> Reviewed-By:
-
yorkie authored
We use tls.TLSSocket type in tls.md, so that needs to be added to doctool's typeMap PR-URL: https://github.com/nodejs/node/pull/8742 Reviewed-By:
-
Eugene Ostroukhov authored
Remove obsolete build file entries. Reviewed-By:
-
Eugene Ostroukhov authored
Reviewed-By:
-
yorkie authored
PR-URL: https://github.com/nodejs/node/pull/8741 Reviewed-By:
-
- Sep 26, 2016
-
-
Bartosz Sosnowski authored
This changes child-process-exec-stdout benchmark to use 'yes' instead of echo in a while loop. This makes this benchmark consistent with child-process-read which already uses `yes` and allows this benchmark to be executed on Windows. Reviewed-By:
-
Bartosz Sosnowski authored
This changes the way v8-bench.js reports its performance to be consistent with other benchmarks. Reviewed-By:
Andreas Madsen <amwebdk@gmail.com> PR-URL: https://github.com/nodejs/node/pull/8564
-
Bartosz Sosnowski authored
Adds --expose_internals switch to benchmark runner. This makes misc/freelist.js benchmark run properly Reviewed-By:
-
Yosuke Furukawa authored
PR-URL: https://github.com/nodejs/node/pull/8587 Reviewed-By:
-
Rich Trott authored
AIX handles closed stdio differently (but still compliant with spec as far as I can tell) than other POSIX variants we test. Test results are different than Linux and others because AIX takes measures to not re-use the file descriptors for stdio if one of the stdio streams is closed. Fixes: https://github.com/nodejs/node/issues/8375 PR-URL: https://github.com/nodejs/node/pull/8755 Reviewed-By:
-
