- Feb 05, 2020
-
-
Sam Roberts authored
See: https://hackerone.com/reports/735748 PR-URL: https://github.com/nodejs-private/node-private/pull/192 Reviewed-By:
Beth <Griggs <Bethany.Griggs@uk.ibm.com>
-
Sam Roberts authored
PR-URL: https://github.com/nodejs-private/http-parser-private/pull/4 Reviewed-By:
Matteo <Collina <matteo.collina@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Sam Roberts <vieuxtech@gmail.com>
-
Anna Henningsen authored
From the issue: > Some servers deviate from HTTP spec enougth that Node.js can't > communicate with them, but "work" when `--insecure-http-parser` > is enabled globally. It would be useful to be able to use this > mode, as a client, only when connecting to known bad servers. This is largely equivalent to https://github.com/nodejs/node/pull/31446 in terms of code changes. Fixes: https://github.com/nodejs/node/issues/31440 Refs: https://github.com/nodejs/node/pull/31446 Backport-PR-URL: https://github.com/nodejs/node/pull/30471 PR-URL: https://github.com/nodejs/node/pull/31448 Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com>
-
Sam Roberts authored
Test that using --insecure-http-parser will disable validation of invalid characters in HTTP headers. See: - https://github.com/nodejs/node/pull/30567 Backport-PR-URL: https://github.com/nodejs/node/pull/30471 PR-URL: https://github.com/nodejs/node/pull/31253 Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de>
-
Sam Roberts authored
Allow insecure HTTP header parsing. Make clear it is insecure. See: - https://github.com/nodejs/node/pull/30553 - https://github.com/nodejs/node/issues/27711#issuecomment-556265881 - https://github.com/nodejs/node/issues/30515 Backport-PR-URL: https://github.com/nodejs/node/pull/30471 PR-URL: https://github.com/nodejs/node/pull/30567 Reviewed-By:
Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Denys Otrishko <shishugi@gmail.com> Reviewed-By:
-
- Feb 04, 2020
-
-
Sam Roberts authored
PR-URL: https://github.com/nodejs/node/pull/30471 Reviewed-By:
Jiawen Geng <technicalcute@gmail.com> Reviewed-By:
Beth Griggs <Bethany.Griggs@uk.ibm.com>
-
- Feb 03, 2020
-
-
Fedor Indutny authored
`X509V3_EXT_print` can return value different from `1` if the X509 extension does not support printing to a buffer. Instead of failing with an unrecoverable assertion - replace the relevant value in the hashmap with a JS null value. Fixes: https://hackerone.com/reports/746733 Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/193 PR-URL: https://github.com/nodejs-private/node-private/pull/175 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
-
- Feb 01, 2020
-
-
Sam Roberts authored
HTTP header values can have trailing OWS, but it should be stripped. It is not semantically part of the header's value, and if treated as part of the value, it can cause spurious inequality between expected and actual header values. Note that a single SPC of leading OWS is common before the field-value, and it is already handled by the HTTP parser by stripping all leading OWS. It is only the trailing OWS that must be stripped by the parser user. header-field = field-name ":" OWS field-value OWS ; https://tools.ietf.org/html/rfc7230#section-3.2 OWS = *( SP / HTAB ) ; https://tools.ietf.org/html/rfc7230#section-3.2.3 Fixes: https://hackerone.com/reports/730779 PR-URL: https://github.com/nodejs-private/node-private/pull/191 Reviewed-By:
Ben <Noordhuis <info@bnoordhuis.nl> Reviewed-By:
-
- Jan 10, 2020
-
-
Beth Griggs authored
PR-URL: https://github.com/nodejs/node/pull/31248
-
- Jan 09, 2020
-
-
Beth Griggs authored
- http2: fix session memory accounting after pausing (Michael Lehenbauer) [#30684](https://github.com/nodejs/node/pull/30684) - n-api: correct bug in napi_get_last_error (Octavian Soldea) [#28702](https://github.com/nodejs/node/pull/28702) - tools: update tzdata to 2019c (Myles Borins) [#30479](https://github.com/nodejs/node/pull/30479) PR-URL: https://github.com/nodejs/node/pull/31248
-
- Jan 07, 2020
-
-
Robert Nagy authored
MAX_HWM was added in 9208c890 where the highwatermark was changed to always increase in steps of highest power of 2 to prevent increasing hwm excessivly in tiny amounts. Why a limit was added on the highwatermark is unclear but breaks existing usage where a larger read size is used. The invariant for read(n) is that a buffer of size n is always returned. Considering a maximum ceiling on the buffer size breaks this invariant. This PR significantly increases the limit to make it less likely to break the previous invariant and also documents the limit. Fixes: https://github.com/nodejs/node/issues/29933 PR-URL: https://github.com/nodejs/node/pull/29938 Reviewed-By:
Matteo Collina <matteo.collina@gmail.com>
-
- Dec 31, 2019
-
-
Rich Trott authored
This will allow us to lint for use of `hostname` in prose without flagging `hostname` in code within headers. This also allows us to remove backslash escaping for `[` and `]` inside of header code, which makes the bare markdown more readable. Backport-PR-URL: https://github.com/nodejs/node/pull/31109 PR-URL: https://github.com/nodejs/node/pull/31086 Reviewed-By:
-
Rich Trott authored
Allow use of <code> in header elements without styling side effects. We can add styling later if desired. The goal here is to allow code to be set off in markdown without needing to escape characters and do lint exceptions for terms. This is probably a win in terms of accessibility too although it would be moreso if we had some visual differentiation for <code> inside of headers. As mentioned above, that can always be added at a later time. Backport-PR-URL: https://github.com/nodejs/node/pull/31109 PR-URL: https://github.com/nodejs/node/pull/31086 Reviewed-By:
-
- Dec 18, 2019
-
-
Michael Lehenbauer authored
The ability to pause input processing was added in 8a4a1931 but introduced a session memory accounting mismatch leading to potential NGHTTP2_ENHANCE_YOUR_CALM errors. After pausing (https://github.com/nodejs/node/blob/f36331c1bfa4c4c202346b05dc3bd672f653e4df/src/node_http2.cc#L871), the early return on line 873 skips the DecrementCurrentSessionMemory(stream_buf_.len) call below (line 878). When we later finished processing the input chunk (https://github.com/nodejs/node/blob/f36331c1bfa4c4c202346b05dc3bd672f653e4df/src/node_http2.cc#L1858), we were calling DecrementCurrentSessionMemory(stream_buf_offset_) [line 1875] which was a no-op since we just set stream_buf_offset_ to 0 [line 1873]. The correct amount to decrement by is still stream_buf_.len, since that's the amount we skipped previously (line 878). Fixes: https://github.com/nodejs/node/issues/29223 Refs: https://github.com/nodejs/node/commit/164ac5b241b96089e6bad5bb83ea416966b3245f PR-URL: https://github.com/nodejs/node/pull/30684 Reviewed-By:
David Carlier <devnexen@gmail.com>
-
Matteo Collina authored
See: https://github.com/nodejs/readable-stream/pull/420 PR-URL: https://github.com/nodejs/node/pull/30140 Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
-
ZYSzys authored
Fixes: https://github.com/nodejs/node/issues/29764 PR-URL: https://github.com/nodejs/node/pull/29780 Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Anto Aravinth <anto.aravinth.cse@gmail.com> Reviewed-By:
-
Yang Guo authored
PR-URL: https://github.com/nodejs/node/pull/25868 Refs: https://github.com/nodejs/node/issues/25867 Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
-
João Reis authored
Don't exit vcbuild with error code 0 when cctest fails. Backport-PR-URL: https://github.com/nodejs/node/pull/30726 PR-URL: https://github.com/nodejs/node/pull/30724 Refs: https://github.com/nodejs/build/issues/1996 Reviewed-By:
Rod Vagg <rod@vagg.org> Reviewed-By:
-
Octavian Soldea authored
napi_get_last_error returns incorrect napi_status. Backport-PR-URL: https://github.com/nodejs/node/pull/30532 PR-URL: https://github.com/nodejs/node/pull/28702 Reviewed-By:
Gabriel Schulhof <gabriel.schulhof@intel.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com>
-
Michaël Zasso authored
Original commit message: [Intl] Fix output of hour:'2-digit', hour12: true Bug: chromium:527926 Change-Id: I783ba59c6e4b117163e058032fb04283e1f43c46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1529260 Reviewed-by:Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/master@{#60379} Refs: https://github.com/v8/v8/commit/fb63e5cf55e93d7b4df51d3f382a6c84d25a5e86 Fixes: https://github.com/nodejs/node/issues/30369 Backport-PR-URL: https://github.com/nodejs/node/pull/30372
-
Myles Borins authored
Refs: https://github.com/nodejs/node/issues/30211 Refs: https://github.com/nodejs/node/pull/30356 PR-URL: https://github.com/nodejs/node/pull/30479 Reviewed-By:
Steven R Loomis <srloomis@us.ibm.com> Reviewed-By:
-
Vse Mozhet Byt authored
Backport-PR-URL: https://github.com/nodejs/node/pull/30338 PR-URL: https://github.com/nodejs/node/pull/24641 Reviewed-By:
Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
-
Sam Roberts authored
https://ci.nodejs.org/job/node-test-commit-v8-linux/configure echoes python code into tools and runs it. Move these scripts into tools for better maintainability. Once this lands and is back-ported into LTS branches a bunch of shell code can be deleted from the job. PR-URL: https://github.com/nodejs/node/pull/28458 Reviewed-By:
-
Sam Roberts authored
The devtoolset doesn't use or set the CXX, etc, env vars, so ignore them if not present. PR-URL: https://github.com/nodejs/node/pull/28458 Reviewed-By:
-
Saagar Jha authored
PR-URL: https://github.com/nodejs/node/pull/28071 Reviewed-By:
-
Myles Borins authored
PR-URL: https://github.com/nodejs/node/pull/30940
-
- Dec 17, 2019
-
-
Myles Borins authored
This is a security release. For more details about the vulnerability please consult the npm blog: https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli Notable Changes: * deps: update npm to 6.13.4 https://github.com/nodejs/node/pull/30904 PR-URL: https://github.com/nodejs/node/pull/30940
-
João Reis authored
Backport-PR-URL: https://github.com/nodejs/node/pull/30726 PR-URL: https://github.com/nodejs/node/pull/30724 Refs: https://github.com/nodejs/build/issues/1996 Reviewed-By:
-
- Dec 14, 2019
-
-
isaacs authored
PR-URL: https://github.com/nodejs/node/pull/30904 Reviewed-By:
Daijiro Wachi <daijiro.wachi@gmail.com>
-
- Oct 23, 2019
-
-
Beth Griggs authored
PR-URL: https://github.com/nodejs/node/pull/29875
-
- Oct 22, 2019
-
-
Beth Griggs authored
Notable changes: * crypto: * add support for chacha20-poly1305 for AEAD (chux0519) https://github.com/nodejs/node/pull/24081 * increase maxmem range from 32 to 53 bits (Tobias Nießen) https://github.com/nodejs/node/pull/28799 * deps: * update npm to 6.11.3 (claudiahdz) https://github.com/nodejs/node/pull/29430 * upgrade openssl sources to 1.1.1d (Sam Roberts) https://github.com/nodejs/node/pull/29921 * dns: * remove dns.promises experimental warning (cjihrig) https://github.com/nodejs/node/pull/26592 * fs: * remove experimental warning for fs.promises (Anna Henningsen) https://github.com/nodejs/node/pull/26581 * http: * makes response.writeHead return the response (Mark S. Everitt) https://github.com/nodejs/node/pull/25974 * http2: * makes response.writeHead return the response (Mark S. Everitt) https://github.com/nodejs/node/pull/25974 * n-api: * make func argument of napi\_create\_threadsafe\_function optional (legendecas) https://github.com/nodejs/node/pull/27791 * mark version 5 N-APIs as stable (Gabriel Schulhof) https://github.com/nodejs/node/pull/29401 * implement date object (Jarrod Connolly) https://github.com/nodejs/node/pull/25917 * process: * add --unhandled-rejections flag (Ruben Bridgewater) https://github.com/nodejs/node/pull/26599 * stream: * implement Readable.from async iterator utility (Guy Bedford) https://github.com/nodejs/node/pull/27660 * make Symbol.asyncIterator support stable (Matteo Collina) https://github.com/nodejs/node/pull/26989 PR-URL: https://github.com/nodejs/node/pull/29875
-
- Oct 21, 2019
-
-
chux0519 authored
openSSL supports AEAD_CHACHA20_POLY1305(rfc7539) since 1.1. PR-URL: https://github.com/nodejs/node/pull/24081 Fixes: https://github.com/nodejs/node/issues/24080 Refs: https://tools.ietf.org/html/rfc7539 Reviewed-By:
Tobias Nießen <tniessen@tnie.de>
-
- Oct 19, 2019
-
-
claudiahdz authored
PR-URL: https://github.com/nodejs/node/pull/29430 Reviewed-By:
-
isaacs authored
BUGFIXES * [`27cccfbda`](https://github.com/npm/cli/commit/27cccfbdac8526cc807b07f416355949b1372a9b) [#223](https://github.com/npm/cli/pull/223) vulns → vulnerabilities in npm audit output ([@sapegin](https://github.com/sapegin)) * [`d5e865eb7`](https://github.com/npm/cli/commit/d5e865eb79329665a927cc2767b4395c03045dbb) [#222](https://github.com/npm/cli/pull/222) [#226](https://github.com/npm/cli/pull/226) install, doctor: don't crash if registry unset ([@dmitrydvorkin](https://github.com/dmitrydvorkin), [@isaacs](https://github.com/isaacs)) * [`5b3890226`](https://github.com/npm/cli/commit/5b389022652abeb0e1c278a152550eb95bc6c452) [#227](https://github.com/npm/cli/pull/227) [npm.community#9167](https://npm.community/t/npm-err-cb-never-called-permission-denied/9167/5) Handle unhandledRejections, tell user what to do when encountering an `EACCES` error in the cache. ([@isaacs](https://github.com/isaacs)) DEPENDENCIES * [`77516df6e`](https://github.com/npm/cli/commit/77516df6eac94a6d7acb5e9ca06feaa0868d779b) `licensee@7.0.3` ([@isaacs](https://github.com/isaacs)) * [`ceb993590`](https://github.com/npm/cli/commit/ceb993590e4e376a9a78264ce7bb4327fbbb37fe) `query-string@6.8.2` ([@isaacs](https://github.com/isaacs)) * [`4050b9189`](https://github.com/npm/cli/commit/4050b91898c60e9b22998cf82b70b9b822de592a) `hosted-git-info@2.8.2` * [#46](https://github.com/npm/hosted-git-info/issues/46) [#43](https://github.com/npm/hosted-git-info/issues/43) [#47](https://github.com/npm/hosted-git-info/pull/47) [#44](https://github.com/npm/hosted-git-info/pull/44) Add support for GitLab subgroups ([@mterrel](https://github.com/mterrel), [@isaacs](https://github.com/isaacs), [@ybiquitous](https://github.com/ybiquitous)) * [`3b1d629`](https://github.com/npm/hosted-git-info/commit/3b1d629) [#48](https://github.com/npm/hosted-git-info/issues/48) fix http protocol using sshurl by default ([@fengmk2](https://github.com/fengmk2)) * [`5d4a8d7`](https://github.com/npm/hosted-git-info/commit/5d4a8d7) ignore noCommittish on tarball url generation ([@isaacs](https://github.com/isaacs)) * [`1692435`](https://github.com/npm/hosted-git-info/commit/1692435) use gist tarball url that works for anonymous gists ([@isaacs](https://github.com/isaacs)) * [`d5cf830`](https://github.com/npm/hosted-git-info/commit/d5cf8309be7af884032616c63ea302ce49dd321c) Do not allow invalid gist urls ([@isaacs](https://github.com/isaacs)) * [`e518222`](https://github.com/npm/hosted-git-info/commit/e5182224351183ce619dd5ef00019ae700ed37b7) Use LRU cache to prevent unbounded memory consumption ([@iarna](https://github.com/iarna)) PR-URL: https://github.com/nodejs/node/pull/29023 Reviewed-By:
-
isaacs authored
PR-URL: https://github.com/nodejs/node/pull/28853 Reviewed-By:
Yongsheng Zhang <zyszys98@gmail.com>
-
isaacs authored
PR-URL: https://github.com/nodejs/node/pull/28525 Reviewed-By:
Roman Reiss <me@silverwind.io> Reviewed-By:
-
- Oct 18, 2019
-
-
Sam Roberts authored
EVP_PKEY_CTX_set_rsa_keygen_pubexp() accepts ownership of the exponent on success, so do not free it. Fixes: https://github.com/nodejs/node/issues/27087 Fixes: https://github.com/nodejs/node/issues/29433 PR-URL: https://github.com/nodejs/node/pull/27092 Reviewed-By:
-
cjihrig authored
PR-URL: https://github.com/nodejs/node/pull/26592 Reviewed-By:
Michaël Zasso <targos@protonmail.com>
-
cjihrig authored
PR-URL: https://github.com/nodejs/node/pull/26592 Reviewed-By:
-
cjihrig authored
PR-URL: https://github.com/nodejs/node/pull/26592 Reviewed-By:
-
