Co-Authored-By: Gabriel Schulhof <gabriel.schulhof@intel.com>

PR-URL: https://github.com/nodejs/node/pull/30006
Backport-PR-URL: https://github.com/nodejs/node/pull/31384


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Gabriel Schulhof <gabriel.schulhof@intel.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

They fail on OS X 10.15 (aka "Catalina"), but pass on earlier OS X.

Refs: https://github.com/nodejs/node/issues/30030
Refs: https://github.com/nodejs/build/pull/2189#issuecomment-589767606

PR-URL: https://github.com/nodejs/node/pull/31936


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

PR-URL: https://github.com/nodejs/node/pull/31358


Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/30931


Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

The test was using fixed timeouts and that seems to be causing sporadic
test failures on pi1-docker host (which is a very slow machine.)

Fixes: https://github.com/nodejs/node/issues/30828

PR-URL: https://github.com/nodejs/node/pull/30834


Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Gabriel Schulhof <gabriel.schulhof@intel.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

PR-URL: https://github.com/nodejs/node/pull/31753
Refs: https://github.com/v8/v8/commit/d89f4ef1cd629cb169f0d9efcaefd05ebf09fd3d


Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

This commit back-ports the implementations of IsRename() and MayAlias()
from the upstream 8.0 branch wholesale. Fixes several bugs where V8's
load elimination pass considered values to be alive when they weren't.

Fixes: https://github.com/nodejs/node/issues/31484

PR-URL: https://github.com/nodejs/node/pull/31613


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>

Adds `napi_set_instance_data()` and `napi_get_instance_data()`, which
allow native addons to store their data on and retrieve their data from
`napi_env`. `napi_set_instance_data()` accepts a finalizer which is
called when the `node::Environment()` is destroyed.

This entails rendering the `napi_env` local to each add-on.

Fixes: https://github.com/nodejs/abi-stable-node/issues/378
PR-URL: https://github.com/nodejs/node/pull/28682
Backport-PR-URL: https://github.com/nodejs/node/pull/30537


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

These do not need to be macros.

PR-URL: https://github.com/nodejs/node/pull/26128
Backport-PR-URL: https://github.com/nodejs/node/pull/30537


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

The test failed in CI once with a timeout but there is insufficient
information to further debug. Add additional debugging information.

Refactored callbacks to be arrow functions, since that seems to be the
direction we're moving.

PR-URL: https://github.com/nodejs/node/pull/31698


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Backport-PR-URL: https://github.com/nodejs/node/pull/30361
PR-URL: https://github.com/nodejs/node/pull/19691


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Backport CLI switches for default TLS versions:
- `--tls-max-v1.2`
- `--tls-min-v1.0`
- `--tls-min-v1.1`
- `--tls-min-v1.2`

PR-URL: https://github.com/nodejs/node/pull/27946


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>

EAI_FAIL is expected on OpenBSD, and has been observed on
platforms such as FreeBSD and Windows. This commit makes
EAI_FAIL an acceptable error code on all platforms.

PR-URL: https://github.com/nodejs/node/pull/27500
Fixes: https://github.com/nodejs/node/issues/27487


Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/30848


Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Rich Trott <rtrott@gmail.com>

These tests are already marked as flaky on 12.x and master.

PR-URL: https://github.com/nodejs/node/pull/31887


Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/27277


Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/31558


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/31304


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

PR-URL: https://github.com/nodejs-private/node-private/pull/198

This is a security release.

Vulnerabilities fixed:
* **CVE-2019-15606**:
          HTTP header values do not have trailing OWS trimmed.
* **CVE-2019-15605**:
          HTTP request smuggling using malformed Transfer-Encoding header.
* **CVE-2019-15604**:
          Remotely trigger an assertion on a TLS server with a malformed
          certificate string.

Also, HTTP parsing is more strict to be more secure. Since this may
cause problems in interoperability with some non-conformant HTTP
implementations, it is possible to disable the strict checks with the
`--insecure-http-parser` command line flag, or the `insecureHTTPParser`
http option. Using the insecure HTTP parser should be avoided.

PR-URL: https://github.com/nodejs-private/node-private/pull/198

See: https://hackerone.com/reports/735748

PR-URL: https://github.com/nodejs-private/node-private/pull/192


Reviewed-By: Beth <Griggs &lt;Bethany.Griggs@uk.ibm.com>

PR-URL: https://github.com/nodejs-private/http-parser-private/pull/4


Reviewed-By: Matteo <Collina &lt;matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>

From the issue:

> Some servers deviate from HTTP spec enougth that Node.js can't
> communicate with them, but "work" when `--insecure-http-parser`
> is enabled globally. It would be useful to be able to use this
> mode, as a client, only when connecting to known bad servers.

This is largely equivalent to https://github.com/nodejs/node/pull/31446
in terms of code changes.

Fixes: https://github.com/nodejs/node/issues/31440
Refs: https://github.com/nodejs/node/pull/31446

Backport-PR-URL: https://github.com/nodejs/node/pull/30471
PR-URL: https://github.com/nodejs/node/pull/31448


Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

Test that using --insecure-http-parser will disable validation of
invalid characters in HTTP headers.

See:
- https://github.com/nodejs/node/pull/30567

Backport-PR-URL: https://github.com/nodejs/node/pull/30471
PR-URL: https://github.com/nodejs/node/pull/31253


Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Allow insecure HTTP header parsing. Make clear it is insecure.

See:
- https://github.com/nodejs/node/pull/30553
- https://github.com/nodejs/node/issues/27711#issuecomment-556265881
- https://github.com/nodejs/node/issues/30515

Backport-PR-URL: https://github.com/nodejs/node/pull/30471
PR-URL: https://github.com/nodejs/node/pull/30567


Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/30471


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>

`X509V3_EXT_print` can return value different from `1` if the X509
extension does not support printing to a buffer. Instead of failing with
an unrecoverable assertion - replace the relevant value in the hashmap
with a JS null value.

Fixes: https://hackerone.com/reports/746733

Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/193
PR-URL: https://github.com/nodejs-private/node-private/pull/175


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>

HTTP header values can have trailing OWS, but it should be stripped.  It
is not semantically part of the header's value, and if treated as part
of the value, it can cause spurious inequality between expected and
actual header values.

Note that a single SPC of leading OWS is common before the field-value,
and it is already handled by the HTTP parser by stripping all leading
OWS. It is only the trailing OWS that must be stripped by the parser
user.

	header-field   = field-name ":" OWS field-value OWS
	    ; https://tools.ietf.org/html/rfc7230#section-3.2
	OWS            = *( SP / HTAB )
	    ; https://tools.ietf.org/html/rfc7230#section-3.2.3

Fixes: https://hackerone.com/reports/730779

PR-URL: https://github.com/nodejs-private/node-private/pull/191


Reviewed-By: Matteo <Collina &lt;matteo.collina@gmail.com>
Reviewed-By: Ben <Noordhuis &lt;info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/31248

- http2: fix session memory accounting after pausing (Michael Lehenbauer)
  [#30684](https://github.com/nodejs/node/pull/30684)
- n-api: correct bug in napi_get_last_error (Octavian Soldea)
  [#28702](https://github.com/nodejs/node/pull/28702)
- tools: update tzdata to 2019c (Myles Borins)
  [#30479](https://github.com/nodejs/node/pull/30479)

PR-URL: https://github.com/nodejs/node/pull/31248

MAX_HWM was added in 9208c890 where the highwatermark was changed to
always increase in steps of highest power of 2 to prevent increasing
hwm excessivly in tiny amounts.

Why a limit was added on the highwatermark is unclear but breaks
existing usage where a larger read size is used. The invariant for
read(n) is that a buffer of size n is always returned. Considering
a maximum ceiling on the buffer size breaks this invariant.

This PR significantly increases the limit to make it less likely to
break the previous invariant and also documents the limit.

Fixes: https://github.com/nodejs/node/issues/29933

PR-URL: https://github.com/nodejs/node/pull/29938


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

This will allow us to lint for use of `hostname` in prose without
flagging `hostname` in code within headers. This also allows us to
remove backslash escaping for `[` and `]` inside of header code, which
makes the bare markdown more readable.

Backport-PR-URL: https://github.com/nodejs/node/pull/31109
PR-URL: https://github.com/nodejs/node/pull/31086


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Allow use of <code> in header elements without styling side effects. We
can add styling later if desired. The goal here is to allow code to be
set off in markdown without needing to escape characters and do lint
exceptions for terms. This is probably a win in terms of accessibility
too although it would be moreso if we had some visual differentiation
for <code> inside of headers. As mentioned above, that can always be
added at a later time.

Backport-PR-URL: https://github.com/nodejs/node/pull/31109
PR-URL: https://github.com/nodejs/node/pull/31086


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

The ability to pause input processing was added in 8a4a1931 but
introduced a session memory accounting mismatch leading to potential
NGHTTP2_ENHANCE_YOUR_CALM errors.

After pausing
(https://github.com/nodejs/node/blob/f36331c1bfa4c4c202346b05dc3bd672f653e4df/src/node_http2.cc#L871),
the early return on line 873 skips the
DecrementCurrentSessionMemory(stream_buf_.len) call below (line 878).

When we later finished processing the input chunk
(https://github.com/nodejs/node/blob/f36331c1bfa4c4c202346b05dc3bd672f653e4df/src/node_http2.cc#L1858),
we were calling DecrementCurrentSessionMemory(stream_buf_offset_) [line
1875] which was a no-op since we just set stream_buf_offset_ to 0 [line
1873].

The correct amount to decrement by is still stream_buf_.len, since
that's the amount we skipped previously (line 878).

Fixes: https://github.com/nodejs/node/issues/29223
Refs: https://github.com/nodejs/node/commit/164ac5b241b96089e6bad5bb83ea416966b3245f

PR-URL: https://github.com/nodejs/node/pull/30684


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: David Carlier <devnexen@gmail.com>

See: https://github.com/nodejs/readable-stream/pull/420

PR-URL: https://github.com/nodejs/node/pull/30140


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>

Fixes: https://github.com/nodejs/node/issues/29764

PR-URL: https://github.com/nodejs/node/pull/29780


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: Anto Aravinth <anto.aravinth.cse@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

PR-URL: https://github.com/nodejs/node/pull/25868
Refs: https://github.com/nodejs/node/issues/25867


Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Gus Caplan <me@gus.host>

Don't exit vcbuild with error code 0 when cctest fails.

Backport-PR-URL: https://github.com/nodejs/node/pull/30726
PR-URL: https://github.com/nodejs/node/pull/30724
Refs: https://github.com/nodejs/build/issues/1996


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

napi_get_last_error returns incorrect napi_status.

Backport-PR-URL: https://github.com/nodejs/node/pull/30532
PR-URL: https://github.com/nodejs/node/pull/28702


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gabriel Schulhof <gabriel.schulhof@intel.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Original commit message:

    [Intl] Fix output of hour:'2-digit', hour12: true

    Bug: chromium:527926
    Change-Id: I783ba59c6e4b117163e058032fb04283e1f43c46
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1529260


Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
    Commit-Queue: Frank Tang <ftang@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#60379}

Refs: https://github.com/v8/v8/commit/fb63e5cf55e93d7b4df51d3f382a6c84d25a5e86

Fixes: https://github.com/nodejs/node/issues/30369

Backport-PR-URL: https://github.com/nodejs/node/pull/30372