- Nov 28, 2018
-
-
James M Snell authored
PR-URL: https://github.com/nodejs/node/pull/23745 Fixes: https://github.com/nodejs/node/issues/9822 Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com>
-
Vasili Skurydzin authored
Floating this patch since the code does not exist upstream anymore. deps/v8/testing/gtest.gyp: Supperss -Wnonnull-compare, -Waddress warnings for deps/v8/testing/gtest project; deps/v8/src/compiler/store-store-elimination.cc, deps/v8/src/conversions.cc: Suppress unused function warnings in order to compile with newer (>4.8.5) gcc on Aix. PR-URL: https://github.com/nodejs/node/pull/23958 Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By:
George Adams <george.adams@uk.ibm.com>
-
Vasili Skurydzin authored
Original commit message: ppc64, aix: Pass CallFrequency object by const reference to avoid value copy error. Bug: v8:8193 GCC bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61976 Change-Id: I0d4efca4da03ef82651325e15ddf2160022bc8de Reviewed-on: https://chromium-review.googlesource.com/1228633 Reviewed-by:Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Daniel Clifford <danno@chromium.org> Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#56275} PR-URL: https://github.com/nodejs/node/pull/23958 Reviewed-By:
-
Vasili Skurydzin authored
Only changes to src/base/debug/stack_trace_posix.cc included Original commit message: Fixes to V8 GN build process on aix platform src/base/debug/stack_trace_posix.cc: suppressed unused function warnings for functions DemangleSymbols, OutputPointer(in order to compile with -Werror flag) test/cctest/test-isolate-independent-builtins.cc: corrections to make ByteInText test case compatible with aix. (affects aix only) Change-Id: I49e45e63545404c77aaed3f51b26557f6f03455e Reviewed-on: https://chromium-review.googlesource.com/927484 Reviewed-by:Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#52071} PR-URL: https://github.com/nodejs/node/pull/23958 Reviewed-By:
-
Rod Vagg authored
PR-URL: https://github.com/nodejs-private/node-private/pull/154
-
- Nov 27, 2018
-
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) * Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js) * Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) * Node.js: HTTP request splitting (CVE-2018-12116) * OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734) * OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) Notable Changes: * deps: Upgrade to OpenSSL 1.0.2q, fixing CVE-2018-0734 and CVE-2018-5407 * http: * Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina) * A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with `server.headersTimeout`. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with `server.setTimeout()`, this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). * Two-byte characters are now strictly disallowed for the `path` option in HTTP client requests. Paths containing characters outside of the range `\u0021` - `\u00ff` will now be rejected with a `TypeError`. This behavior can be reverted if necessary by supplying the `--security-revert=CVE-2018-12116` command line argument (this is not recommended). Reported as security concern for Node.js 6 and 8 by Arkadiy Tetelman (lob.com), fixed by backporting a change by Benno Fünfstück applied to Node.js 10 and later. (CVE-2018-12116 / Matteo Collina) * url: Fix a bug that would allow a hostname being spoofed when parsing URLs with `url.parse()` with the `'javascript:'` protocol. Reported by Martin Bajanik (kenticocloud.com). (CVE-2018-12123 / Matteo Collina) PR-URL: https://github.com/nodejs-private/node-private/pull/154
-
Matteo Collina authored
PR-URL: https://github.com/nodejs-private/node-private/pull/146 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Timothy Gu <timothygu99@gmail.com> Reviewed-By:
-
Benno Fünfstück authored
CVE-2018-12116 Backport of b961d9fd to 8.x Original commit: This commit changes node's handling of two-byte characters in the path component of an http URL. Previously, node would just strip the higher byte when generating the request. So this code: ``` http.request({host: "example.com", port: "80", "/Ｎ"}) ``` would request `http://example.com/.` (`.` is the character for the byte `0x2e`). This is not useful and can in some cases lead to filter evasion. With this change, the code generates `ERR_UNESCAPED_CHARACTERS`, just like space and control characters already did. PR-URL: https://github.com/nodejs/node/pull/16237 Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
-
Matteo Collina authored
CVE-2018-12123 Fixes: https://github.com/nodejs-private/security/issues/205 PR-URL: https://github.com/nodejs-private/node-private/pull/145 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
-
Matteo Collina authored
CVE-2018-12122 An attacker can send a char/s within headers and exahust the resources (file descriptors) of a system even with a tight max header length protection. This PR destroys a socket if it has not received the headers in 40s. PR-URL: https://github.com/nodejs-private/node-private/pull/151 Ref: https://github.com/nodejs-private/node-private/pull/144 Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
-
Matteo Collina authored
CVE-2018-12121 PR-URL: https://github.com/nodejs-private/node-private/pull/143 Ref: https://github.com/nodejs-private/security/issues/139 Ref: https://github.com/nodejs-private/http-parser-private/pull/2 Reviewed-By:
Rod Vagg <rod@vagg.org> Reviewed-By:
-
- Nov 24, 2018
-
-
Shigeki Ohtsu authored
In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Fixes: https://github.com/nodejs/io.js/issues/1461 PR-URL: https://github.com/nodejs/io.js/pull/1836 Reviewed-By:
-
Shigeki Ohtsu authored
Reapply b9106137 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
-
Shigeki Ohtsu authored
See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
-
Fedor Indutny authored
`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Shigeki Ohtsu <ohtsu@iij.ad.jp>
-
Sam Roberts authored
All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Header files were generated by: $ cd deps/openssl $ mkdir -p openssl/include/openssl $ tar xf .../openssl-1.02q.tar.gz $ cd openssl-1.02q $ ./config $ cd include/openssl $ sed -i '' *.h $ cp *.h ../../../openssl/include/openssl/ PR-URL: https://github.com/nodejs/node/pull/24530 Reviewed-By:
Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
-
Sam Roberts authored
This updates all sources in deps/openssl/openssl with openssl-1.0.2q. PR-URL: https://github.com/nodejs/node/pull/24530 Reviewed-By:
-
- Nov 20, 2018
-
-
Myles Borins authored
PR-URL: https://github.com/nodejs/node/pull/23974
-
Beth Griggs authored
Notable changes: * **assert**: - backport some assert commits (Ruben Bridgewater) [#23223](https://github.com/nodejs/node/pull/23223) * **deps**: - upgrade to libuv 1.23.2 (cjihrig) [#23336](https://github.com/nodejs/node/pull/23336) - V8: cherry-pick 64-bit hash seed commits (Yang Guo) [#23274](https://github.com/nodejs/node/pull/23274) * **http**: - added aborted property to request (Robert Nagy) [#20094](https://github.com/nodejs/node/pull/20094) * **http2**: - graduate from experimental (James M Snell) [#22466](https://github.com/nodejs/node/pull/22466) PR-URL: https://github.com/nodejs/node/pull/23974 -
Ali Ijaz Sheikh authored
CheckMemoryPressure cannot be used ABI-safely from v8.h. Add a alternate implementation of AdjustAmountOfExternalAllocatedMemory and then use that from Node. PR-URL: https://github.com/nodejs/node/pull/24499 Reviewed-By:
Yang Guo <yangguo@chromium.org> Reviewed-By:
Myles Borins <myles.borins@gmail.com>
-
Ali Ijaz Sheikh authored
d868eb78 ended up being an inadvertant ABI change. Remove the call to CheckMemoryPressure from the header itself. PR-URL: https://github.com/nodejs/node/pull/24499 Reviewed-By:
-
- Nov 11, 2018
-
-
cjihrig authored
Backport-PR-URL: https://github.com/nodejs/node/pull/24103 PR-URL: https://github.com/nodejs/node/pull/23336 Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
-
Ben Noordhuis authored
An upcoming change in libuv will remove the artificial EISDIR error. Update the test to reflect that. Refs: https://github.com/libuv/libuv/pull/2025 Backport-PR-URL: https://github.com/nodejs/node/pull/24103 PR-URL: https://github.com/nodejs/node/pull/23330 Reviewed-By:
Santiago Gimeno <santiago.gimeno@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
-
cjihrig authored
Backport-PR-URL: https://github.com/nodejs/node/pull/24103 PR-URL: https://github.com/nodejs/node/pull/22997 Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
-
cjihrig authored
Notable changes: - Restores compatibility with the old IPC protocol. - Adds uv_open_osfhandle(). - Adds uv_os_{get,set}priority(). Backport-PR-URL: https://github.com/nodejs/node/pull/24103 PR-URL: https://github.com/nodejs/node/pull/22365 Fixes: https://github.com/nodejs/node/issues/21671 Fixes: https://github.com/nodejs/node/issues/15433 Refs: https://github.com/nodejs/node/pull/21675 Refs: https://github.com/nodejs/node-addon-api/issues/304 Refs: https://github.com/nodejs/abi-stable-node/issues/318 Reviewed-By: -
cjihrig authored
Backport-PR-URL: https://github.com/nodejs/node/pull/24103 PR-URL: https://github.com/nodejs/node/pull/21731 Reviewed-By:
-
cjihrig authored
Notable changes: - Building via cmake is now supported. PR-URL: https://github.com/libuv/libuv/pull/1850 - Stricter checks have been added to prevent watching the same file descriptor multiple times. PR-URL: https://github.com/libuv/libuv/pull/1851 Refs: https://github.com/nodejs/node/issues/3604 - An IPC deadlock on Windows has been fixed. PR-URL: https://github.com/libuv/libuv/pull/1843 Fixes: https://github.com/nodejs/node/issues/9706 Fixes: https://github.com/nodejs/node/issues/7657 - uv_fs_lchown() has been added. PR-URL: https://github.com/libuv/libuv/pull/1826 Refs: https://github.com/nodejs/node/issues/19868 - uv_fs_copyfile() sets errno on error. PR-URL: https://github.com/libuv/libuv/pull/1881 Fixes: https://github.com/nodejs/node/issues/21329 - uv_fs_fchmod() supports -A files on Windows. PR-URL: https://github.com/libuv/libuv/pull/1819 Refs: https://github.com/nodejs/node/issues/12803 Backport-PR-URL: https://github.com/nodejs/node/pull/24103 PR-URL: https://github.com/nodejs/node/pull/21466 Reviewed-By:
-
cjihrig authored
There is already a check in place to prevent stdin and the IPC channel from sharing a file descriptor. This commit adds a similar check to stdout and stderr. Backport-PR-URL: https://github.com/nodejs/node/pull/24103 Refs: https://github.com/libuv/libuv/pull/1851 Refs: https://github.com/libuv/libuv/issues/1897 PR-URL: https://github.com/nodejs/node/pull/21466 Reviewed-By:
-
cjihrig authored
Backport-PR-URL: https://github.com/nodejs/node/pull/24103 Refs: https://github.com/nodejs/node/pull/19377 PR-URL: https://github.com/nodejs/node/pull/20585 Reviewed-By:
-
cjihrig authored
Backport-PR-URL: https://github.com/nodejs/node/pull/24103 PR-URL: https://github.com/nodejs/node/pull/20129 Fixes: https://github.com/nodejs/node/issues/20112 Fixes: https://github.com/nodejs/node/issues/19903 Reviewed-By:
-
cjihrig authored
Notable changes: - uv_fs_copyfile() adds support for copy-on-write behavior. - uv_relative_path() now uses the long directory name for handle->dirw. - File operations on files > 2 GB on 32-bit platforms are working again. - uv_fs_fchmod() on Windows works on files with the Archive flag cleared. Backport-PR-URL: https://github.com/nodejs/node/pull/24103 Fixes: https://github.com/nodejs/node/issues/19170 Fixes: https://github.com/nodejs/node/issues/19455 Fixes: https://github.com/nodejs/node/issues/12803 PR-URL: https://github.com/nodejs/node/pull/19758 Reviewed-By:
-
- Nov 04, 2018
-
-
Bastian Krol authored
This adds missing async_hooks destroy calls for sockets (in _http_agent.js) and HTTP parsers. We need to emit a destroy in AsyncWrap#AsyncReset before assigning a new async_id when the instance has already been in use and is being recycled, because in that case, we have already emitted an init for the "old" async_id. This also removes a duplicated init call for HTTP parser: Each time a new parser was created, AsyncReset was being called via the C++ Parser class constructor (super constructor AsyncWrap) and also via Parser::Reinitialize. Backport-PR-URL: https://github.com/nodejs/node/pull/23410 PR-URL: https://github.com/nodejs/node/pull/23272 Fixes: https://github.com/nodejs/node/issues/19859 Reviewed-By:
-
Teddy Katz authored
This updates `assert.rejects()` to disallow any errors that are thrown synchronously from the given function. Previously, throwing an error would cause the same behavior as returning a rejected Promise. Fixes: https://github.com/nodejs/node/issues/19646 Backport-PR-URL: https://github.com/nodejs/node/pull/24019 PR-URL: https://github.com/nodejs/node/pull/19650 Reviewed-By:
-
Teddy Katz authored
This updates the test in `test/parallel/test-assert-async.js` to add an assertion that the Promises used in the test end up fulfilled. Previously, if an assertion failure occurred, the Promises would have rejected and a warning would have been logged, but the test would still have exit code 0. Backport-PR-URL: https://github.com/nodejs/node/pull/24019 PR-URL: https://github.com/nodejs/node/pull/19650 Reviewed-By:
-
feugy authored
Implement asynchronous equivalent for assert.throws() and assert.doesNotThrow(). Backport-PR-URL: https://github.com/nodejs/node/pull/24019 PR-URL: https://github.com/nodejs/node/pull/18023 Reviewed-By:
Shingo Inoue <leko.noor@gmail.com> Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
-
- Nov 01, 2018
-
-
Anna Henningsen authored
There’s no need to reset the chunk counter for every write. Backport-PR-URL: https://github.com/nodejs/node/pull/23774 PR-URL: https://github.com/nodejs/node/pull/19206 Reviewed-By:
-
Ruben Bridgewater authored
The current stack trace thrown in case `assert.throws(fn, object)` is used did not filter the stack trace. This fixes it. Backport-PR-URL: https://github.com/nodejs/node/pull/23223 PR-URL: https://github.com/nodejs/node/pull/18595 Reviewed-By:
-
Ruben Bridgewater authored
Using `assert()` or `assert.ok()` resulted in a error since a refactoring. Refs: https://github.com/nodejs/node/pull/17582 Backport-PR-URL: https://github.com/nodejs/node/pull/23223 PR-URL: https://github.com/nodejs/node/pull/17903 Refs: https://github.com/nodejs/node/pull/17582 Reviewed-By:
Tobias Nießen <tniessen@tnie.de> Reviewed-By:
-
Ruben Bridgewater authored
From now on it is possible to use a validation object in throws instead of the other possibilites. Backport-PR-URL: https://github.com/nodejs/node/pull/23223 PR-URL: https://github.com/nodejs/node/pull/17584 Refs: https://github.com/nodejs/node/pull/17557 Reviewed-By:
Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By:
Ron Korving <ron@ronkorving.nl> Reviewed-By:
Yuta Hiroto <hello@about-hiroppy.com>
-
Ruben Bridgewater authored
Throw a TypeError in case a error message is provided in the second argument and a third argument is present as well. This is clearly a mistake and should not be done. Backport-PR-URL: https://github.com/nodejs/node/pull/23223 PR-URL: https://github.com/nodejs/node/pull/17585 Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Evan Lucas <evanlucas@me.com>
-
