BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity
40,720 Commits 266 Branches 972 Tags
079c3460cdc72da170cc912642302855257bcda8
Commit Graph
983 Commits
Author SHA1 Message Date
Michaël Zasso 7fb80e5d27 deps: update timezone to 2024a 
PR-URL: https://github.com/nodejs/node/pull/51723
Refs: https://github.com/unicode-org/icu/releases/tag/release-74-2
Refs: https://github.com/nodejs/node/pull/51721
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: LiviaMedeiros <livia@cirno.name>
Reviewed-By: Steven R Loomis <srl295@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
 2024-02-15 19:46:31 +00:00
RafaelGSS e9f395e77a lib: use cache fs internals against path traversal 
PR-URL: https://github.com/nodejs-private/node-private/pull/516
Fixes: https://hackerone.com/bugs?subject=nodejs&report_id=2259914
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
CVE-ID: CVE-2024-21891
 2024-02-14 14:27:35 -03:00
Tobias Nießen 46ce278079 fs: protect against modified Buffer internals in possiblyTransformPath 
Use encodeUtf8String from the encoding_binding internal binding to
convert the result of path.resolve() to a Uint8Array instead of using
Buffer.from(), whose result can be manipulated by the user by
monkey-patching internals such as Buffer.prototype.utf8Write.

HackerOne report: https://hackerone.com/reports/2218653

PR-URL: https://github.com/nodejs-private/node-private/pull/497
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2024-21896
 2024-02-14 14:27:34 -03:00
Joyee Cheung c307ad7686 sea: support sea.getRawAsset() 
This patch adds support for `sea.getRawAsset()` which is
similar to `sea.getAsset()` but returns the raw asset
in an array buffer without copying. Users should avoid
writing to the returned array buffer. If the injected
section is not marked as writable or not aligned,
writing to the raw asset is likely to result in a crash.

PR-URL: https://github.com/nodejs/node/pull/50960
Refs: https://github.com/nodejs/single-executable/issues/68
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
 2024-02-02 15:25:34 +01:00
Joyee Cheung ce8f085d26 sea: support embedding assets 
With this patch:

Users can now include assets by adding a key-path dictionary
to the configuration as the `assets` field. At build time, Node.js
would read the assets from the specified paths and bundle them into
the preparation blob. In the generated executable, users can retrieve
the assets using the `sea.getAsset()` and `sea.getAssetAsBlob()` API.

```json
{
  "main": "/path/to/bundled/script.js",
  "output": "/path/to/write/the/generated/blob.blob",
  "assets": {
    "a.jpg": "/path/to/a.jpg",
    "b.txt": "/path/to/b.txt"
  }
}
```

The single-executable application can access the assets as follows:

```cjs
const { getAsset } = require('node:sea');
// Returns a copy of the data in an ArrayBuffer
const image = getAsset('a.jpg');
// Returns a string decoded from the asset as UTF8.
const text = getAsset('b.txt', 'utf8');
// Returns a Blob containing the asset.
const blob = getAssetAsBlob('a.jpg');
```

Drive-by: update the  documentation to include a section dedicated
to the injected main script and refer to it as "injected main
script" instead of "injected module" because it's a script, not
a module.

PR-URL: https://github.com/nodejs/node/pull/50960
Refs: https://github.com/nodejs/single-executable/issues/68
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
 2024-02-02 15:25:34 +01:00
IlyasShabi 8b2836611e src: support multi-line values for .env file 
PR-URL: https://github.com/nodejs/node/pull/51289
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
 2024-01-31 13:09:13 +00:00
Paulo Chaves 09da597535 test: remove common.expectsError calls for asserts 
PR-URL: https://github.com/nodejs/node/pull/51504
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2024-01-25 21:47:22 +00:00
Yagiz Nizipli 0056147a87 src: add process.loadEnvFile and util.parseEnv 
PR-URL: https://github.com/nodejs/node/pull/51476
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2024-01-23 18:46:26 +00:00
Filip Skokan 6c342431e4 test,crypto: update WebCryptoAPI WPT 
PR-URL: https://github.com/nodejs/node/pull/51533
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2024-01-22 10:42:30 +00:00
Node.js GitHub Bot e57a32a03a deps: update timezone to 2023d 
PR-URL: https://github.com/nodejs/node/pull/51461
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2024-01-21 18:22:28 +00:00
Marco Ippolito 880c90c873 src: terminate correctly double-quote in env variable 
PR-URL: https://github.com/nodejs/node/pull/51510
Fixes: https://github.com/nodejs/node/issues/51508
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2024-01-20 09:44:13 +00:00
Tim Stableford d755f1ae88 lib: allow checking the test result from afterEach 
PR-URL: https://github.com/nodejs/node/pull/51485
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2024-01-19 14:56:06 +00:00
Rafael Gonzaga cf68d006c0 test: add URL tests to fs-write 
PR-URL: https://github.com/nodejs/node/pull/51352
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: LiviaMedeiros <livia@cirno.name>
 2024-01-12 15:28:32 +01:00
Andrés Morelos 09a506fe7d test: remove unneeded common.expectsError for asserts 
PR-URL: https://github.com/nodejs/node/pull/51353
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2024-01-07 22:08:28 +00:00
Rafael Gonzaga 22f4482587 fs,test: add URL to string to fs.watch 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/51346
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2024-01-05 00:49:07 +00:00
Mattias Buelens 2e81415d9a stream: implement min option for ReadableStreamBYOBReader.read 
PR-URL: https://github.com/nodejs/node/pull/50888
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
 2024-01-04 12:57:14 +01:00
Michaël Zasso c64e6035a6 src: do not treat all paths ending with node_modules as such 
Fixes: https://github.com/nodejs/node/issues/51245
PR-URL: https://github.com/nodejs/node/pull/51269
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 2023-12-25 11:44:26 +00:00
Antoine du Hamel a717fa2111 esm: fix hint on invalid module specifier 
PR-URL: https://github.com/nodejs/node/pull/51223
Fixes: https://github.com/nodejs/node/issues/51216
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2023-12-23 20:38:08 +00:00
Chengzhong Wu 147abb99d1 lib: expose default prepareStackTrace 
Expose the default prepareStackTrace implementation as
`Error.prepareStackTrace` so that userland can chain up formatting of
stack traces with built-in source maps support.

PR-URL: https://github.com/nodejs/node/pull/50827
Fixes: https://github.com/nodejs/node/issues/50733
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2023-12-21 16:56:35 +00:00
Rafael Gonzaga 335ecda433 test: add URL tests to fs-read in pm 
PR-URL: https://github.com/nodejs/node/pull/51213
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2023-12-21 12:56:02 +00:00
Pulkit Gupta 71e19e8f08 test_runner: fixed to run after hook if before throws an error 
PR-URL: https://github.com/nodejs/node/pull/51062
Refs: https://github.com/nodejs/node/issues/50842
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Raz Luvaton <rluvaton@gmail.com>
 2023-12-17 21:15:02 +00:00
Debadree Chatterjee 7a2a4d07fe stream: implement TransformStream cleanup using "transformer.cancel" 
Fixes: https://github.com/nodejs/node/issues/49971
PR-URL: https://github.com/nodejs/node/pull/50126
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2023-12-15 07:54:19 +00:00
Joyee Cheung 5fd5c1eca3 test: test syncrhnous methods of child_process in snapshot 
These currently work in snapshot builder scripts. Asynchronous
methods are not supported yet.

PR-URL: https://github.com/nodejs/node/pull/50943
Refs: https://github.com/nodejs/node/issues/50924
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2023-12-14 22:11:28 +01:00
Moshe Atlow cb08703c80 test: fix test runner colored output test 
PR-URL: https://github.com/nodejs/node/pull/51064
Reviewed-By: Raz Luvaton <rluvaton@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2023-12-10 07:44:43 +00:00
Bruce MacNaughton ab857e138f esm: fix hook name in error message 
PR-URL: https://github.com/nodejs/node/pull/50466
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2023-12-05 19:54:01 +01:00
华 77e3dfca5c lib: don't parse windows drive letters as schemes 
We were incorrectly parsing windows drive letters as schemes. This was
polluting the source map cache with malformed file paths.

Fixes: https://github.com/nodejs/node/issues/50523
PR-URL: https://github.com/nodejs/node/pull/50580
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2023-12-05 09:24:14 +00:00
Francesco Trotta 2602c4642b esm: do not call getSource when format is commonjs 
Ensure that `defaultLoad` does not uselessly access the file system to
get the source of modules that are known to be in CommonJS format.

This allows CommonJS imports to resolve in the current phase of the
event loop.

Refs: https://github.com/eslint/eslint/pull/17683
PR-URL: https://github.com/nodejs/node/pull/50465
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2023-11-29 09:21:54 +00:00
Joyee Cheung 97c29def52 test: consolidate utf8 text fixtures in tests 
We previously used a text that appears to be an excerpt of
https://zh.wikipedia.org/wiki/%E5%8D%97%E8%B6%8A%E5%9B%BD
and can have copyright/license complications. It may
also include some geopolitical nuances. The text has been
repeated through out the code base without much reuse.

This patch consolidates the fixtures by adding a common helper
string as `fixtures.utf8TestText` which is identical to a copy
in test/fixtures/utf8_test_text.txt. It also updates the text
to a copy of 蘭亭集序, It was chosen because:

1. It's a well-known Chinese classical piece written in 353 CE
   and therefore in public domain. The string is copied from
   https://zh.wikisource.org/zh-hant/%E8%98%AD%E4%BA%AD%E9%9B%86%E5%BA%8F
   which contains a disclaimer of copyright for this reason.
2. The text is in suitable length for general UTF8 string
   read/write tests (including punctuations, 389 code points and
   1167 bytes).
3. This is also commonly used as reference text for Chinese text
   layout tests.
4. It's a timeless and harmless preface for a collection of poems,
   written by a uncontroversial figure who passed away >1600 years
   ago and contains no geopolitical nuances. Background and an
   English translation of this text can be found at
   https://en.wikipedia.org/wiki/Lantingji_Xu

PR-URL: https://github.com/nodejs/node/pull/50732
Reviewed-By: Yagiz Nizipli <yagiz.nizipli@sentry.io>
 2023-11-28 17:18:02 +00:00
Ethan ArrowoodGeoffrey BoothAntoine du Hamel
 		a0b66383f1 src: add --disable-warning option 
Co-authored-by: Geoffrey Booth <webadmin@geoffreybooth.com>
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/50661
Fixes: https://github.com/nodejs/node/issues/30810
Fixes: https://github.com/nodejs/node/issues/47478
Fixes: https://github.com/nodejs/node/issues/46862
Fixes: https://github.com/nodejs/node/issues/40940
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
 2023-11-21 20:30:02 +00:00
Filip Skokan e0bbe8fd52 test: update WPT files for WebIDL tests 
PR-URL: https://github.com/nodejs/node/pull/50712
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2023-11-19 07:36:31 +00:00
Yagiz NizipliandDaniel Lemire f13dbfd43a src: move package resolver to c++ 
Co-authored-by: Daniel Lemire <daniel@lemire.me>
PR-URL: https://github.com/nodejs/node/pull/50322
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2023-11-17 00:16:38 +00:00
Kumar Rishav 1e0b75c3df tls: fix order of setting cipher before setting cert and key 
Set the cipher list and cipher suite before anything else
because @SECLEVEL=<n> changes the security level and
that affects subsequent operations.

Fixes: https://github.com/nodejs/node/issues/36655
Fixes: https://github.com/nodejs/node/issues/49549
Refs: https://github.com/orgs/nodejs/discussions/49634
Refs: https://github.com/orgs/nodejs/discussions/46545
Refs: https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html
PR-URL: https://github.com/nodejs/node/pull/50186
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
 2023-11-16 14:40:37 +00:00
Chengzhong Wu fc2862b7f5 module: bootstrap module loaders in shadow realm 
This bootstraps ESM loaders in the ShadowRealm with
`ShadowRealm.prototype.importValue` as its entry point and enables
loading ESM and CJS modules in the ShadowRealm. The module is imported
without a parent URL and resolved with the current process's working
directory.

PR-URL: https://github.com/nodejs/node/pull/48655
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
 2023-11-13 22:09:47 +08:00
Filip Skokan 635a5c8dcd test,stream: enable compression WPTs 
PR-URL: https://github.com/nodejs/node/pull/50631
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2023-11-12 10:01:50 +00:00
Aras Abbasi 83e6350b82 errors: improve hideStackFrames 
PR-URL: https://github.com/nodejs/node/pull/49990
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2023-11-11 16:25:08 +00:00
Antoine du Hamel 0dfc59e4fc esm: bypass CJS loader in default load under --default-type=module 
This allows user to opt-out from using the monkey-patchable CJS loader,
even to load CJS modules.

PR-URL: https://github.com/nodejs/node/pull/50004
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2023-11-10 09:20:46 +01:00
Yagiz Nizipli 4dbb017301 test: improve UV_THREADPOOL_SIZE tests on .env 
PR-URL: https://github.com/nodejs/node/pull/49213
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2023-11-03 17:25:54 +00:00
Antoine du Hamel a3e09b3fdd module: execute --import sequentially 
PR-URL: https://github.com/nodejs/node/pull/50474
Fixes: https://github.com/nodejs/node/issues/50427
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2023-11-01 12:38:01 +00:00
Joshua LeMay 65087c0486 test: migrate message v8 tests from Python to JS 
PR-URL: https://github.com/nodejs/node/pull/50421
Fixes: https://github.com/nodejs/node/issues/47707
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2023-10-29 05:55:01 +00:00
Moshe Atlow 5fab505c76 test_runner: output errors of suites 
PR-URL: https://github.com/nodejs/node/pull/50361
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2023-10-26 09:10:24 +00:00
Luke Albao 9c714d8232 test: v8: Add test-linux-perf-logger test suite 
PR-URL: https://github.com/nodejs/node/pull/50352
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
 2023-10-25 23:37:54 +00:00
Phil Nash c60c11aae1 test_runner: adds built in lcov reporter 
Fixes https://github.com/nodejs/node/issues/49626

PR-URL: https://github.com/nodejs/node/pull/50018
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
 2023-10-25 12:11:32 +00:00
Antoine du Hamel c38ba67a0d test: deflake test-esm-loader-resolve-type 
PR-URL: https://github.com/nodejs/node/pull/50273
Fixes: https://github.com/nodejs/node/issues/50040
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
 2023-10-21 09:25:11 +00:00
Yagiz Nizipli 6678a09b59 test: update url web platform tests 
PR-URL: https://github.com/nodejs/node/pull/50264
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2023-10-20 21:57:33 +00:00
Geoffrey Booth 02926d3c6a esm: detect ESM syntax in ambiguous JavaScript 
PR-URL: https://github.com/nodejs/node/pull/50096
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
 2023-10-20 15:44:56 +00:00
Tobias Nießen 0c5696248b test: fix defect path traversal tests 
The test never actually tested what it claims to test because it did not
properly insert separators before `..`.

PR-URL: https://github.com/nodejs/node/pull/50124
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2023-10-16 15:50:28 +00:00
Antoine du Hamel d1ef6aa2db esm: use import attributes instead of import assertions 
The old import assertions proposal has been
renamed to "import attributes" with the follwing major changes:

1. The keyword is now `with` instead of `assert`.
2. Unknown assertions cause an error rather than being ignored,

This commit updates the documentation to encourage folks to use the new
syntax, and add aliases for module customization hooks.

PR-URL: https://github.com/nodejs/node/pull/50140
Fixes: https://github.com/nodejs/node/issues/50134
Refs: https://github.com/v8/v8/commit/159c82c5e6392e78b9bba7161b1bed6e23758984
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2023-10-14 03:52:38 +00:00
Tobias Nießen f447a4611a permission: fix Uint8Array path traversal 
Previous security patches addressed path traversal vulnerabilities for
string and Buffer inputs, but ignored Uint8Array inputs. This commit
fixes the existing logic to account for the latter.

The previous implementation would silently ignore unexpected inputs,
whereas this commit introduces an explicit assertion to prevent that
unsafe behavior.

PR-URL: https://github.com/nodejs-private/node-private/pull/456
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2023-39332
 2023-10-13 18:05:15 -03:00
Tobias Nießen 32bcf4ca27 permission: improve path traversal protection 
Always use the original implementation of pathModule.resolve. If the
application overwrites the value of pathModule.resolve with a custom
implementation, it should not have any effect on the permission model.

PR-URL: https://github.com/nodejs-private/node-private/pull/456
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2023-39331
 2023-10-13 18:05:10 -03:00
Tobias Nießen 3b23b2ee53 module: fix code injection through export names 
createDynamicModule() properly escapes import names, but not export
names. In WebAssembly, any string is a valid export name. Importing a
WebAssembly module that uses a non-identifier export name leads to
either a syntax error in createDynamicModule() or to code injection,
that is, to the evaluation of almost arbitrary JavaScript code outside
of the WebAssembly module.

To address this issue, adopt the same mechanism in createExport() that
createImport() already uses. Add tests for both exports and imports.

PR-URL: https://github.com/nodejs-private/node-private/pull/461
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/489
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2023-39333
 2023-10-13 18:03:52 -03:00