- Nov 28, 2018
-
-
Anto Aravinth authored
Fixes: https://github.com/nodejs/node/issues/24340 PR-URL: https://github.com/nodejs/node/pull/24655 Refs: https://github.com/nodejs/node/issues/24340 Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Shingo Inoue <leko.noor@gmail.com> Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com> Reviewed-By:
Weijia Wang <starkwang@126.com>
-
sagirk authored
In `test/parallel/test-child-process-env.js`, callbacks use anonymous closure functions. It is safe to replace them with arrow functions since these callbacks don't contain references to `this`, `super` or `arguments`. This results in shorter functions. PR-URL: https://github.com/nodejs/node/pull/24482 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
Rich Trott <rtrott@gmail.com>
-
Daiki Arai authored
convert to Arrow Function and test by `./tools/test.py tick-processor` PR-URL: https://github.com/nodejs/node/pull/24615 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Masashi Hirano <shisama07@gmail.com>
-
Takahiro Nakamura authored
PR-URL: https://github.com/nodejs/node/pull/24621 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Masashi Hirano <shisama07@gmail.com>
-
susantruong authored
PR-URL: https://github.com/nodejs/node/pull/24584 Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com>
-
Anatoli Papirovski authored
PR-URL: https://github.com/nodejs/node/pull/24632 Fixes: https://github.com/nodejs/node/issues/24209 Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By:
Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
-
apoorvanand authored
PR-URL: https://github.com/nodejs/node/pull/24441 Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com>
-
Rich Trott authored
Revise the "Accepting Modifications" section of the Collaborator Guide. PR-URL: https://github.com/nodejs/node/pull/24650 Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Franziska Hinkelmann <franziska.hinkelmann@gmail.com> Reviewed-By:
Richard Lau <riclau@uk.ibm.com>
-
VeysonD authored
PR-URL: https://github.com/nodejs/node/pull/24622 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com>
-
DoiChris authored
In lib/internal/streams/async_iterator.js, use arrow function for callback. PR-URL: https://github.com/nodejs/node/pull/24609 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Ron Korving <ron@ronkorving.nl> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com>
-
feng jianmei authored
PR-URL: https://github.com/nodejs/node/pull/24594 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Shingo Inoue <leko.noor@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com>
-
ajido authored
PR-URL: https://github.com/nodejs/node/pull/24087 Refs: https://github.com/nodejs/node/pull/23937 Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com>
-
Matteo Collina authored
Fixes: https://github.com/nodejs/node/issues/24550 PR-URL: https://github.com/nodejs/node/pull/24571 Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Bartosz Sosnowski <bartosz@janeasystems.com>
-
Rich Trott authored
The processing of strings like `8.x` into a major version number and a minor version number results in minor versions that are `NaN`. In that situation, since the picker will link to the latest docs in the major version, include the version in the version picker. Fixes: https://github.com/nodejs/node/issues/23979 PR-URL: https://github.com/nodejs/node/pull/24638 Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) * Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js) * Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) * OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734) * OpenSSL: Timing vulnerability in ECDSA signature generation (CVE-2019-0735) Notable Changes: * deps: Upgrade to OpenSSL 1.1.0j, fixing CVE-2018-0734 and CVE-2019-0735 * http: * Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina) * A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with `server.headersTimeout`. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with `server.setTimeout()`, this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). * url: Fix a bug that would allow a hostname being spoofed when parsing URLs with `url.parse()` with the `'javascript:'` protocol. Reported by Martin Bajanik (kenticocloud.com). (CVE-2018-12123 / Matteo Collina) PR-URL: https://github.com/nodejs-private/node-private/pull/156/
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) * Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js) * Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) * OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734) * OpenSSL: Timing vulnerability in ECDSA signature generation (CVE-2019-0735) Notable Changes: * deps: Upgrade to OpenSSL 1.1.0j, fixing CVE-2018-0734 and CVE-2019-0735 * http: * Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina) * A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with `server.headersTimeout`. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with `server.setTimeout()`, this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). * url: Fix a bug that would allow a hostname being spoofed when parsing URLs with `url.parse()` with the `'javascript:'` protocol. Reported by Martin Bajanik (kenticocloud.com). (CVE-2018-12123 / Matteo Collina) PR-URL: https://github.com/nodejs-private/node-private/pull/155/
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) * Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js) * Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) * Node.js: HTTP request splitting (CVE-2018-12116) * OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734) * OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) Notable Changes: * deps: Upgrade to OpenSSL 1.0.2q, fixing CVE-2018-0734 and CVE-2018-5407 * http: * Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina) * A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with `server.headersTimeout`. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with `server.setTimeout()`, this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). * Two-byte characters are now strictly disallowed for the `path` option in HTTP client requests. Paths containing characters outside of the range `\u0021` - `\u00ff` will now be rejected with a `TypeError`. This behavior can be reverted if necessary by supplying the `--security-revert=CVE-2018-12116` command line argument (this is not recommended). Reported as security concern for Node.js 6 and 8 by Arkadiy Tetelman (lob.com), fixed by backporting a change by Benno Fünfstück applied to Node.js 10 and later. (CVE-2018-12116 / Matteo Collina) * url: Fix a bug that would allow a hostname being spoofed when parsing URLs with `url.parse()` with the `'javascript:'` protocol. Reported by Martin Bajanik (kenticocloud.com). (CVE-2018-12123 / Matteo Collina) PR-URL: https://github.com/nodejs-private/node-private/pull/154
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * Node.js: Debugger port 5858 listens on any interface by default (CVE-2018-12120) * Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) * Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js) * Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) * Node.js: HTTP request splitting (CVE-2018-12116) * OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734) * OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) Notable Changes: * debugger: Backport of https://github.com/nodejs/node/pull/8106 to prevent the debugger from listening on `0.0.0.0`. It now defaults to `127.0.0.1`. Reported by Ben Noordhuis. (CVE-2018-12120 / Ben Noordhuis). * deps: Upgrade to OpenSSL 1.0.2q, fixing CVE-2018-0734 and CVE-2018-5407 * http: * Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina) * A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with `server.headersTimeout`. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with `server.setTimeout()`, this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). (CVE-2018-12122 / Matteo Collina) * Two-byte characters are now strictly disallowed for the `path` option in HTTP client requests. Paths containing characters outside of the range `\u0021` - `\u00ff` will now be rejected with a `TypeError`. This behavior can be reverted if necessary by supplying the `--security-revert=CVE-2018-12116` command line argument (this is not recommended). Reported as security concern for Node.js 6 and 8 by Arkadiy Tetelman (lob.com), fixed by backporting a change by Benno Fünfstück applied to Node.js 10 and later. (CVE-2018-12116 / Matteo Collina) * url: Fix a bug that would allow a hostname being spoofed when parsing URLs with `url.parse()` with the `'javascript:'` protocol. Reported by Martin Bajanik (kenticocloud.com). (CVE-2018-12123 / Matteo Collina) PR-URL: https://github.com/nodejs-private/node-private/pull/153
-
Matteo Collina authored
CVE-2018-12123 Fixes: https://github.com/nodejs-private/security/issues/205 PR-URL: https://github.com/nodejs-private/node-private/pull/145 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
Matteo Collina authored
CVE-2018-12122 An attacker can send a char/s within headers and exahust the resources (file descriptors) of a system even with a tight max header length protection. This PR destroys a socket if it has not received the headers in 40s. PR-URL: https://github.com/nodejs-private/node-private/pull/144 Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
James M Snell <jasnell@gmail.com>
-
Rod Vagg authored
PR-URL: https://github.com/nodejs-private/node-private/pull/149 Reviewed-By:
Fedor Indutny <fedor@indutny.com>
-
Fedor Indutny authored
Ref: https://github.com/nodejs-private/node-private/pull/143 PR-URL: https://github.com/nodejs-private/node-private/pull/149 Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Rod Vagg authored
CVE-2018-12121 As per nodejs-private/node-private#149 for http_parse but for llhttp Ref: https://github.com/nodejs-private/node-private/pull/143 PR-URL: https://github.com/nodejs-private/node-private/pull/149 Reviewed-By:
Matteo Collina <hello@matteocollina.com>
-
Matteo Collina authored
CVE-2018-12121 PR-URL: https://github.com/nodejs-private/node-private/pull/143 Ref: https://github.com/nodejs-private/security/issues/139 Ref: https://github.com/nodejs-private/http-parser-private/pull/2 Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Rod Vagg <rod@vagg.org> Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
tpanthera authored
PR-URL: https://github.com/nodejs/node/pull/24443 Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com>
-
- Nov 27, 2018
-
-
Vse Mozhet Byt authored
PR-URL: https://github.com/nodejs/node/pull/24641 Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
-
cjihrig authored
This commit removes extraneous wrapping of return values in Uptime() and GetParentProcessId(). PR-URL: https://github.com/nodejs/node/pull/24562 Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Jon Moss <me@jonathanmoss.me>
-
Daniel Bevenius authored
This commit adds a crypto check to suppress the crypto related environment variables introduced in Commit 399bb3c9 ("doc: add NODE_DEBUG_NATIVE to API docs"). Without this check, test/parallel/test-cli-node-print-help.js will fail when configured --without-ssl, as it some of the descriptions for these environment variables contain flags that the test is not expecting to find. PR-URL: https://github.com/nodejs/node/pull/24556 Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com>
-
Rich Trott authored
Make it more explicit that symlinks are resolved in `__filename`. Refs: https://github.com/nodejs/node/issues/22602#issuecomment-440906602 PR-URL: https://github.com/nodejs/node/pull/24587 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com>
-
Refael Ackermann authored
PR-URL: https://github.com/nodejs/node/pull/24505 Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
Fedor Indutny <fedor.indutny@gmail.com>
-
- Nov 26, 2018
-
-
Naojirou Hisada authored
PR-URL: https://github.com/nodejs/node/pull/24596 Reviewed-By:
Ron Korving <ron@ronkorving.nl> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com>
-
kazuya kawaguchi authored
replace with C++ API. Refs: https://github.com/nodejs/node/pull/24125 PR-URL: https://github.com/nodejs/node/pull/24614 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
Gus Caplan <me@gus.host>
-
tottokotkd authored
PR-URL: https://github.com/nodejs/node/pull/24612 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Shingo Inoue <leko.noor@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com>
-
kohta ito authored
PR-URL: https://github.com/nodejs/node/pull/24601 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Shingo Inoue <leko.noor@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com>
-
yosuke ota authored
Changed function expression to arrow function. PR-URL: https://github.com/nodejs/node/pull/24597 Reviewed-By:
Ron Korving <ron@ronkorving.nl> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com>
-
takato authored
PR-URL: https://github.com/nodejs/node/pull/24589 Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Shingo Inoue <leko.noor@gmail.com>
-
koki-oshima authored
PR-URL: https://github.com/nodejs/node/pull/24606 Reviewed-By:
Ron Korving <ron@ronkorving.nl> Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com>
-
Rich Trott authored
Simplify and clarify the text of the COLLABORATORS_GUIDE where handling one's own pull requests is concerned. PR-URL: https://github.com/nodejs/node/pull/24583 Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com> Reviewed-By:
Yuta Hiroto <hello@hiroppy.me> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com>
-
cclauss authored
PR-URL: https://github.com/nodejs/node/pull/24486 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
-
Vse Mozhet Byt authored
This replacement can save us a function call, two array spreadings, and an array concatenation. PR-URL: https://github.com/nodejs/node/pull/24582 Refs: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Reflect/ownKeys#Description Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com>
-