BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity
39,264 Commits 266 Branches 972 Tags
41f70568a46efceb59bdb00a727b4fe8d858cb2b
Commit Graph
14109 Commits
Author SHA1 Message Date
yuzheng14 0c8539e336 events: fix bug listenerCount don't compare wrapped listener 
When add listener by once, it will be wrapped into another function.
And when pass listener and there is just one event listener added by
once, it will return 0 even if passed listener equal wrapped event
listener.

Refs: https://github.com/nodejs/node/pull/46523
PR-URL: https://github.com/nodejs/node/pull/48592
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
 2023-07-10 06:33:51 +00:00
Chengzhong Wu 38dee8a1c0 src: distinguish HTML transferable and cloneable 
The HTML structured serialize algorithm treats transferable and
serializable as two different bits. A web platform interface can be
both transferable and serializable.

Splits BaseObject::TransferMode to be able to compose the two bits
and distinguishes the transferable and cloneable.

PR-URL: https://github.com/nodejs/node/pull/47956
Refs: https://github.com/v8/v8/commit/cf13b9b46572a9824d2d632abdd48c56161ace02
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
 2023-07-07 17:00:00 +00:00
Yagiz Nizipli 3205b1936a lib: remove aix directory case for package reader 
PR-URL: https://github.com/nodejs/node/pull/48605
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2023-07-07 15:31:33 +00:00
Devraj Mehta b5e16adb1d http2: send RST code 8 on AbortController signal 
Fixes: https://github.com/nodejs/node/issues/47321
Refs: https://www.rfc-editor.org/rfc/rfc7540#section-7
PR-URL: https://github.com/nodejs/node/pull/48573
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
 2023-07-06 00:59:39 +00:00
Chemi Atlow c3ab184373 events: allow safely adding listener to abortSignal 
PR-URL: https://github.com/nodejs/node/pull/48596
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
 2023-07-05 22:04:23 +00:00
Luigi Pinca 08638b74ec Revert "test: remove test-crypto-keygen flaky designation" 
This reverts commit 893c000046.

Refs: https://github.com/nodejs/node/pull/48575#issuecomment-1620267554
PR-URL: https://github.com/nodejs/node/pull/48652
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
 2023-07-05 16:30:30 +00:00
Moshe Atlow 56b8de1699 timers: support Symbol.dispose 
PR-URL: https://github.com/nodejs/node/pull/48633
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
 2023-07-05 13:39:38 +00:00
Moshe Atlow 773fde29a9 child_process: support Symbol.dispose 
PR-URL: https://github.com/nodejs/node/pull/48551
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2023-07-05 10:21:14 +00:00
Chengzhong Wu c47ea21685 bootstrap: hide experimental web globals with flag kNoBrowserGlobals 
Do not install experimental web globals when the environment is
initialized with embedder flag
`node::EnvironmentFlags::kNoBrowserGlobals`.

PR-URL: https://github.com/nodejs/node/pull/48545
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2023-07-05 07:02:59 +00:00
Raz Luvaton 99881304c4 test_runner: add shards support 
PR-URL: https://github.com/nodejs/node/pull/48639
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2023-07-05 03:57:28 +00:00
Yagiz NizipliMesteryVoltrex
 		b40f0c3074 lib: add navigator.hardwareConcurrency 
Co-authored-by: Mestery <mestery@protonmail.com>
Co-authored-by: Voltrex <mohammadkeyvanzade94@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/47769
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2023-07-04 22:55:34 +00:00
Rafael Gonzagaandhaxatron 74c2d9c8a3 permission: v8.writeHeapSnapshot and process.report 
Co-Authored-By: haxatron <haxatron1@gmail.com>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs/node/pull/48564
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2023-07-04 13:12:48 +00:00
Antoine du Hamel 3ce51ae9c0 module: harmonize error code between ESM and CJS 
PR-URL: https://github.com/nodejs/node/pull/48606
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Jan Krems <jan.krems@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2023-07-04 09:52:56 +00:00
Vinicius Lourenço a2a8e31cbc src,lib: reducing C++ calls of esm legacy main resolve 
Instead of many C++ calls, now we make only one C++ call
to return a enum number that represents the selected state.

PR-URL: https://github.com/nodejs/node/pull/48325
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2023-07-03 18:42:47 +00:00
Shocker d312bd96d3 test_runner: fixed test shorthands return type 
`test.todo`, `test.only` and `test.skip` are expected to return the
same as `test`. This commit corrects the inconsistent behavior of
these shorthands.

Fixes: https://github.com/nodejs/node/issues/48557
PR-URL: https://github.com/nodejs/node/pull/48555
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2023-07-03 09:04:11 +00:00
Luigi Pinca 651c02cbbc http: null the joinDuplicateHeaders property on cleanup 
Null the `joinDuplicateHeaders` property when the parser is freed.

Refs: https://github.com/nodejs/node/pull/45982
PR-URL: https://github.com/nodejs/node/pull/48608
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
 2023-07-03 06:20:13 +00:00
Moshe Atlow 50477fa353 test: add missing assertions to test-runner-cli 
PR-URL: https://github.com/nodejs/node/pull/48593
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 2023-07-02 05:49:00 +00:00
Yagiz Nizipli 951da5282c lib: merge cjs and esm package json reader caches 
PR-URL: https://github.com/nodejs/node/pull/48477
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2023-06-29 18:45:31 +00:00
atlowChemi e8810b91f1 https: server add asyncDispose 
PR-URL: https://github.com/nodejs/node/pull/48548
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2023-06-29 11:53:05 +03:00
atlowChemi b7bfb17bef http2: server add asyncDispose 
PR-URL: https://github.com/nodejs/node/pull/48548
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2023-06-29 11:52:58 +03:00
atlowChemi 909b43fe3a http: server add async dispose 
PR-URL: https://github.com/nodejs/node/pull/48548
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2023-06-29 11:52:51 +03:00
Luigi Pinca 893c000046 test: remove test-crypto-keygen flaky designation 
PR-URL: https://github.com/nodejs/node/pull/48575
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2023-06-29 08:47:12 +00:00
Luigi Pinca 300634d33d test: remove test-timers-immediate-queue flaky designation 
PR-URL: https://github.com/nodejs/node/pull/48575
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2023-06-29 08:47:11 +00:00
Benjamin Gruenbaum 1683e6030e test: add Symbol.dispose support to mock timers 
PR-URL: https://github.com/nodejs/node/pull/48549
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Erick Wendel <erick.workspace@gmail.com>
 2023-06-29 07:45:44 +00:00
Tim Perry 86ba5bea9e tls: add ALPNCallback server option for dynamic ALPN negotiation 
PR-URL: https://github.com/nodejs/node/pull/45190
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
 2023-06-28 14:30:30 +00:00
Paolo Insogna fddd3ffa59 net: improve network family autoselection handle handling 
PR-URL: https://github.com/nodejs/node/pull/48464
Fixes: https://github.com/npm/cli/issues/6409
Fixes: https://github.com/KararTY/dank-twitch-irc/issues/13
Fixes: https://github.com/nodejs/node/issues/47644
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
 2023-06-27 09:17:16 +00:00
killa 32eb4921db fs: call the callback with an error if writeSync fails 
Catch SyncWriteStream write file error.

Fixes: https://github.com/nodejs/node/issues/47948
Signed-off-by: killagu <killa123@126.com>
PR-URL: https://github.com/nodejs/node/pull/47949
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2023-06-26 14:18:58 +00:00
Luigi Pinca d09ff0db70 fs: remove unneeded return statement 
The `writable._write()` implementation does not need to return anything,
only call the callback.

PR-URL: https://github.com/nodejs/node/pull/48526
Reviewed-By: Keyhan Vakil <kvakil@sylph.kvakil.me>
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
 2023-06-26 09:01:35 +00:00
ignoramous 7202859402 net: do not treat server.maxConnections=0 as Infinity 
Setting the `maxConnections` to 0 should result in no connection.
Instead, it was treated as if the option was not there.

PR-URL: https://github.com/nodejs/node/pull/48276
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
 2023-06-26 06:17:51 +00:00
Rafael Gonzaga b38bc9fc89 permission: handle end nodes with children cases 
PR-URL: https://github.com/nodejs/node/pull/48531
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
 2023-06-25 19:11:22 +00:00
Moshe Atlow 7cd4e70948 test_runner: support passing globs 
PR-URL: https://github.com/nodejs/node/pull/47653
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2023-06-25 14:40:34 +00:00
Moshe Atlow 1948dce707 fs: add globSync implementation 
this is currently for internal use only,
with a synchrnous API.

PR-URL: https://github.com/nodejs/node/pull/47653
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2023-06-25 14:40:33 +00:00
Moshe AtlowandBenjamin Gruenbaum 71d7707792 fs, stream: initial Symbol.dispose and Symbol.asyncDispose support 
Co-authored-by: Benjamin Gruenbaum <benjamingr@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/48518
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Erick Wendel <erick.workspace@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2023-06-25 11:18:54 +00:00
Luigi Pinca c308054aaa test: mark test-child-process-stdio-reuse-readable-stdio flaky 
Refs: https://github.com/nodejs/node/issues/48300#issuecomment-1604531463
Refs: https://github.com/nodejs/reliability/issues/597#issue-1772339022
PR-URL: https://github.com/nodejs/node/pull/48537
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2023-06-25 11:08:07 +00:00
Joyee Cheung 42d8143ce5 test: make IsolateData per-isolate in cctest 
This ensures that we only create one IsolateData for each isolate
inthe cctest, since IsolateData are meant to be per-isolate.
We need to make the isolate and isolate_data static in the
test fixtures as a result, similar to how the event loops and
array buffer allocators are managed in the
NodeZeroIsolateTestFixture but it is fine because gtest ensures
that the Setup() and TearDown() of the fixtures are always run
in order and would never overlap in one process.

PR-URL: https://github.com/nodejs/node/pull/48450
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
 2023-06-25 05:41:19 +00:00
Chengzhong Wu e7a1fab25f test: define NAPI_VERSION before including node_api.h 
Include node.h first to define NAPI_VERSION that node binary is built
with. The node.h should also be included first in embedder's use case
since it is the primary header file.

PR-URL: https://github.com/nodejs/node/pull/48376
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
 2023-06-24 17:04:08 +00:00
Antoine du Hamel d9f394e607 test: remove unnecessary noop function args to mustNotCall() 
PR-URL: https://github.com/nodejs/node/pull/48513
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Harshitha K P <harshitha014@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2023-06-24 16:16:07 +02:00
Robert Nagy cebbc57ed2 stream: fix premature pipeline end 
Fixes: https://github.com/nodejs/node/issues/48406
PR-URL: https://github.com/nodejs/node/pull/48435
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2023-06-24 07:58:03 +00:00
isaacs e26ffe7358 module: add SourceMap.findOrigin 
This adds the `SourceMap.findOrigin(lineNumber, columnNumber)` method,
for finding the origin source file and 1-indexed line and column numbers
corresponding to the 1-indexed line and column numbers from a call site
in generated source code.

Fix: #47770
PR-URL: https://github.com/nodejs/node/pull/47790
Fixes: https://github.com/nodejs/node/issues/47770
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2023-06-23 19:17:14 +00:00
geekreal 0d1dfe157e http: remove useless ternary in test 
PR-URL: https://github.com/nodejs/node/pull/48481
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matthew Aitken <maitken033380023@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>
 2023-06-22 19:07:36 +00:00
Chemi Atlow bcd35c334e lib: add option to force handling stopped events 
PR-URL: https://github.com/nodejs/node/pull/48301
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2023-06-22 13:38:02 +00:00
Erick Wendel da80964a3d test_runner: add initial draft for fakeTimers 
Signed-off-by: Erick Wendel <erick.workspace@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/47775
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2023-06-22 04:01:52 +00:00
Moshe Atlow 0afd6e8902 test: skip test-runner-watch-mode on IBMi 
PR-URL: https://github.com/nodejs/node/pull/48473
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Nitzan Uziely <linkgoron@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
 2023-06-21 17:25:19 +00:00
Chengzhong Wu a509753a8e report: disable js stack when no context is entered 
There are no guarantees that the JS stack can be generated when no
context is entered.

PR-URL: https://github.com/nodejs/node/pull/48495
Fixes: https://github.com/nodejs/node-v8/issues/250
Refs: https://chromium-review.googlesource.com/c/v8/v8/+/4582948
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
 2023-06-21 13:58:15 +00:00
RafaelGSS 205f1e643e permission: handle fs path traversal 
PR-URL: https://github.com/nodejs-private/node-private/pull/403
Refs: https://hackerone.com/bugs?subject=nodejs&report_id=1952978
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2023-30584
 2023-06-20 17:31:47 -03:00
RafaelGSS e15cc4595a permission: handle fs.openAsBlob 
Refs: https://hackerone.com/bugs?subject=nodejs&report_id=1966492
PR-URL: https://github.com/nodejs-private/node-private/pull/405
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2023-30583
 2023-06-20 17:31:42 -03:00
Tobias Nießen e8a1affab0 crypto: handle cert with invalid SPKI gracefully 
When attempting to convert the SPKI of a X509Certificate to a KeyObject,
throw an error if the subjectPublicKey cannot be parsed instead of
aborting the process.

Fixes: https://hackerone.com/bugs?report_id=1884159
PR-URL: https://github.com/nodejs-private/node-private/pull/393
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
CVE-ID: CVE-2023-30588
 2023-06-20 17:31:37 -03:00
RafaelGSS daaa43ed96 policy: handle mainModule.__proto__ bypass 
PR-URL: https://github.com/nodejs-private/node-private/pull/416
Fixes: https://hackerone.com/bugs?subject=nodejs&report_id=1877919
Reviewed-By: Rich Trott <rtrott@gmail.com>
CVE-ID: CVE-2023-30581
 2023-06-20 17:31:28 -03:00
Paolo Insogna 2e6de554f6 http: disable request smuggling via empty headers 
PR-URL: https://github.com/nodejs-private/node-private/pull/427
Fixes: https://hackerone.com/reports/2001873
Refs: https://github.com/nodejs-private/llhttp-private/pull/13
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2023-30589
 2023-06-20 17:30:48 -03:00
Tobias Nießen 4a82c8fda0 doc,test: clarify behavior of DH generateKeys 
The DiffieHellman class is an old and thin wrapper around certain
OpenSSL functions, many of which are deprecated in OpenSSL 3.0. Because
the Node.js API mirrors the OpenSSL API, it adopts some of its
peculiarities, but the Node.js documentation does not properly reflect
these. Most importantly, despite the documentation saying otherwise,
diffieHellman.generateKeys() does not generate a new private key when
one has already been set or generated. Based on the documentation alone,
users may be led to misuse the API in a way that results in key reuse,
which can have drastic negative consequences for subsequent operations
that consume the shared secret.

These design issues in this old API have been around for many years, and
we are not currently aware of any misuse in the ecosystem that falls
into the above scenario. Changing the behavior of the API would be a
significant breaking change and is thus not appropriate for a security
release (nor is it a goal.) The reported issue is treated as CWE-1068
(after a vast amount of uncertainty whether to treat it as a
vulnerability at all), therefore, this change only updates the
documentation to match the actual behavior. Tests are also added that
demonstrate this particular oddity.

Newer APIs exist that can be used for some, but not all, Diffie-Hellman
operations (e.g., crypto.diffieHellman() that was added in 2020). We
should keep modernizing crypto APIs, but that is a non-goal for this
security release.

The ECDH class mirrors the DiffieHellman class in many ways, but it does
not appear to be affected by this particular peculiarity. In particular,
ecdh.generateKeys() does appear to always generate a new private key.

PR-URL: https://github.com/nodejs-private/node-private/pull/426
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
CVE-ID: CVE-2023-30590
 2023-06-20 17:30:34 -03:00