PR-URL: https://github.com/nodejs-private/node-private/pull/135

Notable changes:

* **Fixes memory exhaustion DoS** (CVE-2018-7164): Fixes a bug introduced
    in 9.7.0 that increases the memory consumed when reading from the network
    into JavaScript using the net.Socket object directly as a stream.
* **buffer** (CVE-2018-7167): Fixes Denial of Service vulnerability where
    calling Buffer.fill() could hang
* **http2**
  * (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the
    http2 implementation to not crash under certain circumstances during cleanup
  * (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading
    nghttp2 to 1.32.0
* **tls** (CVE-2018-7162): Fixes Denial of Service vulnerability by updating
    the TLS implementation to not crash upon receiving

PR-URL: https://github.com/nodejs-private/node-private/pull/135

Add a mock TLS socket implementation and a regression test for
the previous commit.

Refs: https://github.com/nodejs-private/security/issues/189
PR-URL: https://github.com/nodejs-private/node-private/pull/130


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Evan Lucas <evanlucas@me.com>

Fix an use-after-free bug in the TLS implementation.

If we return from `DoWrite()` with an early error, we should
not be storing the `WriteWrap` object and complete it
again at a later point, when it has already been freed
(because of the write error).

This issue was reported by Jordan Zebor at F5 Networks,
who also helped with investigating this bug and coming
up with a reproduction.

This fixes CVE-2018-7162.

Fixes: https://github.com/nodejs-private/security/issues/189
PR-URL: https://github.com/nodejs-private/node-private/pull/130


Reviewed-By: Evan Lucas <evanlucas@me.com>

This would otherwise keep a lot of unused memory lying around,
and in particular add up to a page per chunk of memory overhead
for network reads, potentially opening a DoS vector if the resulting
`Buffer` objects are kept around indefinitely (e.g. stored in a list
and not concatenated until the socket finishes).

This fixes CVE-2018-7164.

Refs: https://github.com/nodejs-private/security/issues/186
Refs: https://github.com/nodejs/node/commit/7c4b09b24bbe7d6a8cbad256f47b30a101a909ea
PR-URL: https://github.com/nodejs-private/node-private/pull/129


Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>

PR-URL: https://github.com/nodejs-private/node-private/pull/124


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>

This fixes CVE-2018-1000168.

PR-URL: https://github.com/nodejs-private/node-private/pull/124


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>

This fixes CVE-2018-7161.

PR-URL: https://github.com/nodejs-private/node-private/pull/122


Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Note that buffer.fill() can zero-fill on some input types if no
valid fill data remains, but does nothing on other input types.

PR-URL: https://github.com/nodejs-private/node-private/pull/120
Fixes: https://github.com/nodejs-private/security/issues/193
Refs: https://github.com/nodejs-private/node-private/pull/118


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Previously, zero-length Buffers and TypedArrays passed as fillers hanged
Buffer#fill and Buffer.from.

This changes those cases when it hanged to a zero-fill instead, which
should be backwards compatible.

This fixes CVE-2018-7167.

PR-URL: https://github.com/nodejs-private/node-private/pull/120
Fixes: https://github.com/nodejs-private/security/issues/193
Refs: https://github.com/nodejs-private/node-private/pull/118


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/19818

Notable changes:

An infrastructure issue caused a non-functioning msi installer for x64 to be promoted.
The patch release is to ensure that all binaries and installers work as expected.

PR-URL: https://github.com/nodejs/node/pull/19799

Notable changes:

* deps:
  - Updated ICU to 61.1 (Steven R. Loomis)
    [#19621](https://github.com/nodejs/node/pull/19621)
    Includes CLDR 33 (many new languages and data improvements).
* fs:
  - Emit 'ready' event for `ReadStream` and `WriteStream` (Sameer
    Srivastava) [#19408](https://github.com/nodejs/node/pull/19408)
* n-api:
  - Bump version of n-api supported (Michael Dawson)
    [#19497](https://github.com/nodejs/node/pull/19497)
* net:
  - Emit 'ready' event for `Socket` (Sameer Srivastava)
    [#19408](https://github.com/nodejs/node/pull/19408)
* Added new collaborators
  - [mafintosh](https://github.com/mafintosh) Mathias Buus

Do not close the request if callback is not a function, and
throw ERR_INVALID_CALLBACK TypeError

Backport-PR-URL: https://github.com/nodejs/node/pull/19229
PR-URL: https://github.com/nodejs/node/pull/19061
Fixes: https://github.com/nodejs/node/issues/18855


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Shingo Inoue <leko.noor@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

The previous commit deleted lib/module.js so that git
recognize the file move `lib/module.js` ->
`lib/internal/modules/cjs/loader.js`. This commit add the
redirection back.

Backport-PR-URL: https://github.com/nodejs/node/pull/19374
PR-URL: https://github.com/nodejs/node/pull/19177
Refs: https://github.com/nodejs/node/pull/19112


Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

Create `lib/internal/modules` and restructure the module loaders
to make the purpose of those files clearer.

Also make it clear in the code that the object exported by
`lib/internal/modules/cjs/loader.js` is `CJSModule` instead of the
ambiguous `Module`.

Before:

```
lib
├── ...
├── internal
│       ├── loaders
│       │     ├── CreateDynamicModule.js
│       │     ├── DefaultResolve.js
│       │     ├── Loader.js
│       │     ├── ModuleJob.js
│       │     ├── ModuleMap.js
│       │     ├── ModuleWrap.js
│       │     └── Translators.js
│       └── module.js
└── module.js
```

After:

```
lib
├── ...
├── internal
│       ├── ...
│       └── modules
│              ├── cjs
│              │     ├── helpers.js
│              │     └── loader.js
│              └── esm
│                    ├── CreateDynamicModule.js
│                    ├── DefaultResolve.js
│                    ├── Loader.js
│                    ├── ModuleJob.js
│                    ├── ModuleMap.js
│                    └── Translators.js
└── module.js # deleted in this commit to work with git file mode
```

Backport-PR-URL: https://github.com/nodejs/node/pull/19374
PR-URL: https://github.com/nodejs/node/pull/19177
Refs: https://github.com/nodejs/node/pull/19112


Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

Otherwise the debug log output might be mixed up with
the expected errors and the assertion matching the error
message would fail.

Backport-PR-URL: https://github.com/nodejs/node/pull/19374
PR-URL: https://github.com/nodejs/node/pull/19177
Refs: https://github.com/nodejs/node/pull/19112


Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

Create `lib/internal/bootstrap/` and put bootstrappers there:

Before:

```
lib/internal
├── ...
├── bootstrap_loaders.js
└── bootstrap_node.js
```

After:

```
lib/internal
├── ...
└── bootstrap
    ├── loaders.js
    └── node.js
```

Backport-PR-URL: https://github.com/nodejs/node/pull/19374
PR-URL: https://github.com/nodejs/node/pull/19177
Refs: https://github.com/nodejs/node/pull/19112


Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>

- Moves the creation of `process.binding()`, `process._linkedBinding()`
  `internalBinding()` and `NativeModule` into a separate file
  `lib/internal/bootstrap_loaders.js`, and documents them there.
  This file will be compiled and run before `bootstrap_node.js`, which
  means we now bootstrap the internal module & binding system before
  actually bootstrapping Node.js.
- Rename the special ID that can be used to require `NativeModule`
  as `internal/bootstrap_loaders` since it is setup there. Also put
  `internalBinding` in the object exported by `NativeModule.require`
  instead of putting it inside the `NativeModule.wrapper`
- Use the original `getBinding()` to get the source code of native
  modules instead of getting it from `process.binding('native')`
  so that users cannot fake native modules by modifying the binding
  object.
- Names the bootstrapping functions so their names show up
  in the stack trace.

Backport-PR-URL: https://github.com/nodejs/node/pull/19374
PR-URL: https://github.com/nodejs/node/pull/19112


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>

Uses fs.access to implement fs.exists functionality. Fixes a issue,
when a file exists but user does not have privileges to do stat on the
file.

Fixes: https://github.com/nodejs/node/issues/17921

Backport-PR-URL: https://github.com/nodejs/node/pull/19654
PR-URL: https://github.com/nodejs/node/pull/18618


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Weijia Wang <starkwang@126.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

* Replace 2 hyphens (--) by spaced m-dashes (—) as per STYLE_GUIDE.md.
* Space infix operators.
* Unify quotes in inline code spans (use only single quotes).
* Unify `* Returns:` (eliminate deviations).
* Dedupe spaces.

PR-URL: https://github.com/nodejs/node/pull/19743


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

This was added in v8 6.2, looks like a safe replacement for
our own buffer::kMaxLength.

PR-URL: https://github.com/nodejs/node/pull/19738


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Add a `make jstest` target that runs tests written in JavaScript
(excluding documentation tests which are run in `make test-doc`).

PR-URL: https://github.com/nodejs/node/pull/19324


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matheus Marchini <matheus@sthima.com>

Test process.setuid with an object as an argument. An equivalent test
exists for process.seteuid.

PR-URL: https://github.com/nodejs/node/pull/19703
Fixes: https://github.com/nodejs/node/issues/19591


Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

* Fixed "cleanup" being misused as a verb
* "Use of Foo should only be used" construction changed to "Foo should
  only be used..."
* Otherwise-unmentioned "`Persistent`" changed to more understandable
  "persistent"
* remove an instance of unnecessary italics
* wrap at 80 characters

Change all "initialize a...instance to zeroes" to say "with zeroes"
instead. Previously, both formulations appeared.

PR-URL: https://github.com/nodejs/node/pull/19742


Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

Ref: https://github.com/nodejs/node/pull/19502#issuecomment-378450321

PR-URL: https://github.com/nodejs/node/pull/19784


Reviewed-By: Teddy Katz <teddy.katz@gmail.com>
Reviewed-By: Matheus Marchini <matheus@sthima.com>

Use the default assert.strictEqual() message so that unequal values are
shown in the event of an AssertionError.

PR-URL: https://github.com/nodejs/node/pull/19629


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

Remove the message argument from call to assert.strictEqual so
that the AssertionError will report the value of er.code, and add
a comment with the message.

PR-URL: https://github.com/nodejs/node/pull/19659


Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

Fixes: https://github.com/nodejs/node/issues/19457

PR-URL: https://github.com/nodejs/node/pull/19502


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yuta Hiroto <hello@hiroppy.me>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/19773


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>

- argv[0] was being emitted into a utf-8 stream, but argv[0] may
not be legal utf-8
- fix by not emitting argv[0] (was only for a source comment)
- partially resolves https://github.com/nodejs/node/issues/17077

PR-URL: https://github.com/nodejs/node/pull/19756
Fixes: https://github.com/nodejs/node/issues/17077


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Nikolai Vavilov <vvnicholas@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>

Heed the comment to not use fields of a Reference after calling its
finalize callback, because such a call may destroy the Reference.

Fixes: https://github.com/nodejs/node/issues/19673
PR-URL: https://github.com/nodejs/node/pull/19718


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Updated the doc/api/process.md documentation to reflect that
listening on SIGUSR1 could impact the debugger.

Fixes: https://github.com/nodejs/node/issues/19619

PR-URL: https://github.com/nodejs/node/pull/19709


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/19701


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

- Update to released ICU 61.1, including:
  - CLDR 33 (many new languages and data improvements)
  - Many small API additions, improvements, and bug fixes
  - note: 'icu::' namespace is no longer used by default
   (Necessated https://github.com/nodejs/node/pull/18667 )

PR-URL: https://github.com/nodejs/node/pull/19621


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/19762


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Jan Krems <jan.krems@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/19522


Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>

Assumption that stack overflow exception has name == "RangeError" is
v8-specific.  Updated logic to dynamically capture error name when
capturing error message.

PR-URL: https://github.com/nodejs/node/pull/19705


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Use `common.mustCall()` to make sure connection callback runs exactly
once.

Use `connect` event instead of `setTimeout` to avoid test failing if
timer runs before client is connected.

Remove `cluster.worker.disconnect()` after `assert.fail()`. It is
unreachable code that is unnecessary.

PR-URL: https://github.com/nodejs/node/pull/19700


Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>