BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity
35,457 Commits 266 Branches 972 Tags
ce41395f89414dfd459084ea61a7eeac1f67713a
Commit Graph
9406 Commits
Author SHA1 Message Date
Rich Trott 49ba2104c4 util: remove unused fast path in internal debuglog 
The internal `debuglog()` is never called with 0 parameters. Remove the
fast-path for that situation. If it ever occurs, it will fall through to
the default path.

PR-URL: https://github.com/nodejs/node/pull/41605
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
 2022-01-24 14:39:22 +00:00
Benjamin GruenbaumandRobert Nagy a8afe26fca stream: add drop and take 
This adds the `drop` and `take` methods to readable streams allowing
users easily drop and take items from the stream.

This continues the iterator-helper proposal alignment task.

Co-Authored-By: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/41630
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2022-01-23 18:43:16 +02:00
Benjamin Gruenbaum ca489497be stream: never flatten on toArray 
PR-URL: https://github.com/nodejs/node/pull/41615
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-23 08:19:53 +00:00
Benjamin GruenbaumandRobert Nagy cc8931a916 stream: support flatMap 
Support the `flatMap` method from the iterator helper TC39 proposal on
readable streams.

Co-Authored-By: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/41612
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2022-01-23 10:13:17 +02:00
Rich Trott 348469b87a repl: check for precise values rather than falsy in loops 
This prepares the code for the no-cond-assign ESLint rule.

PR-URL: https://github.com/nodejs/node/pull/41614
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2022-01-22 19:38:15 -08:00
Rich Trott ac06951049 util: check for null instead of flasy in loop 
This prepares the code for the no-cond-assign ESLint rule.

PR-URL: https://github.com/nodejs/node/pull/41614
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2022-01-22 19:38:13 -08:00
Rich Trott bd422452da timers: check for nullish instead of falsy in loops 
This prepares the code for the no-cond-assign ESLint rule.

PR-URL: https://github.com/nodejs/node/pull/41614
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2022-01-22 19:38:11 -08:00
Rich Trott e044a5d4e9 process: check for null instead of falsy in while loop 
This prepares the code for the no-cond-assign ESLint rule.

PR-URL: https://github.com/nodejs/node/pull/41614
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2022-01-22 19:38:09 -08:00
Rich Trott 0bc642202f policy: check for null instead of falsy in loop 
This prepares the code for the no-cond-assign ESLint rule.

PR-URL: https://github.com/nodejs/node/pull/41614
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2022-01-22 19:38:07 -08:00
Rich Trott e6fdcbe534 stream: check for null instead of falsy in loops 
Check for null in while loops. This is preparing the code for
the no-cond-assign ESLint rule.

PR-URL: https://github.com/nodejs/node/pull/41614
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2022-01-22 19:38:06 -08:00
Rich Trott c05c8837c1 crypto: revise variables for const use instead of let 
This prepares the code for enabling the no-cond-assign rule.

PR-URL: https://github.com/nodejs/node/pull/41614
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2022-01-22 19:38:04 -08:00
Tobias Nießen 18365d8ee6 crypto: change default check(Host|Email) behavior 
This changes the default behavior of the X509Certificate functions
checkHost and checkEmail to match the default behavior of OpenSSL's
X509_check_host and X509_check_email functions, respectively, which
is also what RFC 2818 mandates for HTTPS.

Refs: https://github.com/nodejs/node/pull/36804
Refs: https://github.com/nodejs/node/pull/41569

PR-URL: https://github.com/nodejs/node/pull/41600
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
 2022-01-22 18:36:47 +01:00
LiviaMedeiros b8de7aa4c2 crypto: adjust types for getRandomValues 
prevents Web Crypto API's getRandomValues from accepting DataView

Fixes: https://github.com/nodejs/node/issues/41480
Refs: https://www.w3.org/TR/WebCryptoAPI/#Crypto-method-getRandomValues

PR-URL: https://github.com/nodejs/node/pull/41481
Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Zeyu Yang <himself65@outlook.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2022-01-22 15:20:40 +01:00
Ray 2f1700463b readline: add feature yank and yank pop 
1. `Ctrl-Y` to yank previously deleted text
2. `Meta-Y` to do yank pop (cycle among deleted texts)
3. Use `getCursorPos().rows` to check if we have reached a new line,
instead of `getCursorPos().cols === 0`.
4. document and unittests.

PR-URL: https://github.com/nodejs/node/pull/41301
Fixes: https://github.com/nodejs/node/issues/41252
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>
 2022-01-22 05:42:48 +00:00
Yoshiki Kurihara feafea1154 lib: fix consistency of methods that emit warnings 
PR-URL: https://github.com/nodejs/node/pull/41249
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Mestery <mestery@protonmail.com>
 2022-01-21 23:53:53 +00:00
Mohammed Keyvanzadeh 82756836b2 process: use validateString validator 
Use the `validateString()` validator where applicable.

PR-URL: https://github.com/nodejs/node/pull/41595
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Mestery <mestery@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2022-01-21 23:46:16 +00:00
Benjamin Gruenbaum 3d23d62373 buffer: alias subarray and slice 
PR-URL: https://github.com/nodejs/node/pull/41596
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-22 00:35:21 +01:00
Rich Trott 290911b99a lib: remove erroneous JSDoc entry 
The entry contains incorrect parameters and duplicates the subsequent
constructor entry. Remove it.

(I'm not sure why this is being caught by the linter on my local machine
but not in CI.)

PR-URL: https://github.com/nodejs/node/pull/41604
Reviewed-By: Mestery <mestery@protonmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
 2022-01-21 14:37:44 -08:00
Ray 271725a363 readline: undo previous edit when get key code 0x1F 
1. Undo previous edit on keystroke `ctrl -` (emit 0x1F)
2. unittests
3. documentation

PR-URL: https://github.com/nodejs/node/pull/41392
Fixes: https://github.com/nodejs/node/issues/41308
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-21 10:24:06 +00:00
Benjamin GruenbaumandRobert Nagy 5badf46f2a stream: support some and every 
This continues on the iterator-helpers work by adding `.some` and
`.every` to readable streams.

Co-Authored-By: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/41573
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2022-01-21 12:10:17 +02:00
Benjamin GruenbaumandRobert Nagy 5a407d606a stream: add toArray 
Add the toArray method from the TC39 iterator helper proposal to
Readable streams. This also enables a common-use case of converting a
stream to an array.

Co-Authored-By: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/41553
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2022-01-20 11:24:29 +02:00
voltrexmaster c4a6f9ab94 stream: rename unknown primordial 
The primordials does not expose a primordial called `DataViewCtor`,
leading up to a non-existent constructor.

Fixes: https://github.com/nodejs/node/issues/40612

PR-URL: https://github.com/nodejs/node/pull/40622
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-20 09:19:37 +00:00
Rongjian Zhang 5753eb102f dgram: remove unreachable connectState assign 
PR-URL: https://github.com/nodejs/node/pull/38590
Reviewed-By: Ouyang Yadong <oyydoibh@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2022-01-20 08:34:52 +00:00
XadillaX 9759695545 lib: modify DOMException to pass WPT 
PR-URL: https://github.com/nodejs/node/pull/41517
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2022-01-20 13:45:54 +08:00
Tobias Nießen 6d666491ce crypto: remove checkIP options argument 
None of the supported options have any effect on X509_check_ip_asc.

Refs: https://github.com/openssl/openssl/pull/17536

PR-URL: https://github.com/nodejs/node/pull/41571
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2022-01-19 19:10:18 +01:00
Tobias Nießen da1b59fc13 crypto: support RFC 2818 compatible checkHost 
The 'subject' option should not only accept the values 'always' and
'never' because neither is compatible with RFC 2818, i.e., HTTPS. This
change adds a third value 'default', which implies the behavior that
HTTPS mandates.

The new 'default' case matches the default behavior of OpenSSL for both
DNS names and email addresses.

Future Node.js versions should change the default option value from
'always' to 'default'.

Refs: https://github.com/nodejs/node/pull/36804

PR-URL: https://github.com/nodejs/node/pull/41569
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2022-01-19 16:05:32 +01:00
Gang Chen 22792c8632 domain: pass opts to EventEmitter.init 
PR-URL: https://github.com/nodejs/node/pull/41414
Fixes: https://github.com/nodejs/node/issues/41391
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-19 11:26:38 +00:00
Jacob Smith dbc6e39ca7 esm: improve validation of resolved URLs 
PR-URL: https://github.com/nodejs/node/pull/41446
Reviewed-By: Bradley Farias <bradley.meck@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
 2022-01-19 05:28:32 +00:00
Anatoli Papirovski 51783320a4 process: ignore asyncId 0 in exception handler 
Today, the global uncaught exception handler is the only
place where asyncId 0 is not ignored and we still proceed
to call emitAfter. This would've already failed one of
our correctness tests in async_hooks if not for some other
code meant to handle a different edge case.

Fixes: https://github.com/nodejs/node/issues/22982

PR-URL: https://github.com/nodejs/node/pull/41424
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2022-01-18 22:05:12 +01:00
Mohammed Keyvanzadeh a1f827a859 policy: replace entries with keys 
Replaced the entries with keys since the values of the entries are not
used, and changed loop style to avoid mangled `Symbol.iterator`s and
to keep consistency.

PR-URL: https://github.com/nodejs/node/pull/41482
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2022-01-17 22:56:11 +00:00
Benjamin GruenbaumandRobert Nagy 3f0bcfb203 stream: add forEach method 
Add a `forEach` method to readable streams to enable concurrent
iteration and align with the iterator-helpers proposal.

Co-Authored-By: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/41445
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
 2022-01-17 14:25:04 +02:00
Rich Trott 20347d5154 stream: avoid function call where possible 
Instead of assigning a boolean, move the function call that assigns a
value to the boolean to the only place that boolean is checked. This
avoids the function call in cases where it is not needed.

Refs: https://github.com/nodejs/node/pull/41488#pullrequestreview-850626528

PR-URL: https://github.com/nodejs/node/pull/41534
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2022-01-17 05:31:30 +00:00
Tobias Nießen 807c7e14f4 tls: move tls.parseCertString to end-of-life 
The internal use of tls.parseCertString was removed in
a336444c7f. The function does not handle
multi-value RDNs correctly, leading to incorrect representations and
security concerns.

This change is breaking in two ways: tls.parseCertString is removed
(but has been runtime-deprecated since Node.js 9) and
_tls_common.translatePeerCertificate does not translate the `subject`
and `issuer` properties anymore.

This change also removes the recommendation to use querystring.parse
instead, which is similarly dangerous.

PR-URL: https://github.com/nodejs/node/pull/41479
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2022-01-15 17:00:25 +01:00
Rich Trott f7be6ab042 stream: remove always-false condition check 
Remove comparison to null of variable guaranteed to be a boolean.

PR-URL: https://github.com/nodejs/node/pull/41488
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
 2022-01-15 00:07:46 +00:00
Rich Trott dcc368f4be tools,lib,test: enable ESLint no-regex-spaces rule 
PR-URL: https://github.com/nodejs/node/pull/41463
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2022-01-13 17:12:05 -08:00
Rich Trott 9bfe60fc20 tools: enable ESLint no-sparse-arrays rule 
PR-URL: https://github.com/nodejs/node/pull/41463
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2022-01-13 17:11:13 -08:00
Gang Chen 775bfd1579 esm: make process.exit() default to exit code 0 
Due to a bug in top-level await implementation, it used to default to
exit code 13.

PR-URL: https://github.com/nodejs/node/pull/41388
Fixes: https://github.com/nodejs/node/issues/40808
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
 2022-01-14 01:37:41 +01:00
XadillaX 38b7961ce6 url,lib: pass urlsearchparams-constructor.any.js 
According to WPT:

1. `URLSearchParams` constructor should throw exactly `TypeError` if any
   Error occurrs.
2. When a record passed to `URLSearchParams` constructor, two different
   key may result same after `toUVString()`. We should leave only the
   later one.

PR-URL: https://github.com/nodejs/node/pull/41197
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
 2022-01-11 18:29:31 +08:00
Rich Trott 8c3637cd35 stream: fix error-path function call 
The `onFinish()` function takes a single argument. The two extra
arguments passed here are already in the function scope, and may result
in the error being mishandled.

PR-URL: https://github.com/nodejs/node/pull/41433
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
 2022-01-11 02:53:21 +00:00
Tobias Nießen 3454e79713 console: fix prototype pollution via console.table 
CVE-ID: CVE-2022-21824
PR-URL: https://github.com/nodejs-private/node-private/pull/307
Refs: https://hackerone.com/reports/1431042
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2022-01-10 22:38:05 +00:00
Tobias Nießen a336444c7f tls: fix handling of x509 subject and issuer 
When subject and verifier are represented as strings, escape special
characters (such as '+') to guarantee unambiguity. Previously, different
distinguished names could result in the same string when encoded. In
particular, inserting a '+' in a single-value Relative Distinguished
Name (e.g., L or OU) would produce a string that is indistinguishable
from a multi-value Relative Distinguished Name. Third-party code that
correctly interprets the generated string representation as a
multi-value Relative Distinguished Name could then be vulnerable to an
injection attack, e.g., when an attacker includes a single-value RDN
with type OU and value 'HR + CN=example.com', the string representation
produced by unpatched versions of Node.js would be
'OU=HR + CN=example.com', which represents a multi-value RDN.

Node.js itself is not vulnerable to this attack because the current
implementation that parses such strings into objects does not handle '+'
at all. This oversight leads to incorrect results, but at the same time
appears to prevent injection attacks (as described above).

With this change, the JavaScript objects representing the subject and
issuer Relative Distinguished Names are constructed in C++ directly,
instead of (incorrectly) encoding them as strings and then (incorrectly)
decoding the strings in JavaScript.

This addresses CVE-2021-44533.

CVE-ID: CVE-2021-44533
PR-URL: https://github.com/nodejs-private/node-private/pull/300
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2022-01-10 22:38:05 +00:00
Tobias Nießen 50439b446f tls: drop support for URI alternative names 
Previously, Node.js incorrectly accepted uniformResourceIdentifier (URI)
subject alternative names in checkServerIdentity regardless of the
application protocol. This was incorrect even in the most common cases.
For example, RFC 2818 specifies (and RFC 6125 confirms) that HTTP over
TLS only uses dNSName and iPAddress subject alternative names, but not
uniformResourceIdentifier subject alternative names.

Additionally, name constrained certificate authorities might not be
constrained to specific URIs, allowing them to issue certificates for
URIs that specify hosts that they would not be allowed to issue dNSName
certificates for.

Even for application protocols that make use of URI subject alternative
names (such as SIP, see RFC 5922), Node.js did not implement the
required checks correctly, for example, because checkServerIdentity
ignores the URI scheme.

As a side effect, this also fixes an edge case. When a hostname is not
an IP address and no dNSName subject alternative name exists, the
subject's Common Name should be considered even when an iPAddress
subject alternative name exists.

It remains possible for users to pass a custom checkServerIdentity
function to the TLS implementation in order to implement custom identity
verification logic.

This addresses CVE-2021-44531.

CVE-ID: CVE-2021-44531
PR-URL: https://github.com/nodejs-private/node-private/pull/300
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2022-01-10 22:38:05 +00:00
Tobias Nießen 466e5415a2 crypto,tls: implement safe x509 GeneralName format 
This change introduces JSON-compatible escaping rules for strings that
include X.509 GeneralName components (see RFC 5280). This non-standard
format avoids ambiguities and prevents injection attacks that could
previously lead to X.509 certificates being accepted even though they
were not valid for the target hostname.

These changes affect the format of subject alternative names and the
format of authority information access. The checkServerIdentity function
has been modified to safely handle the new format, eliminating the
possibility of injecting subject alternative names into the verification
logic.

Because each subject alternative name is only encoded as a JSON string
literal if necessary for security purposes, this change will only be
visible in rare cases.

This addresses CVE-2021-44532.

CVE-ID: CVE-2021-44532
PR-URL: https://github.com/nodejs-private/node-private/pull/300
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2022-01-10 22:38:05 +00:00
Rich Trott b161440cd3 stream: remove unused function argument 
watchClosed() is only ever called with an anonymous function for the
action parameter. This anonymous funciton does not take any arguments.
Remove unused argument from invocation of action().

PR-URL: https://github.com/nodejs/node/pull/41403
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2022-01-07 16:49:16 +00:00
Rich Trott 55ceaec111 tools,benchmark,lib,test: enable no-case-declarations lint rule 
PR-URL: https://github.com/nodejs/node/pull/41385
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Ricky Zhou <0x19951125@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2022-01-05 07:42:19 -08:00
Cheng Zhao a706342368 src: add kNoBrowserGlobals flag for Environment 
PR-URL: https://github.com/nodejs/node/pull/40532
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-05 11:01:49 +00:00
Antoine du Hamel f34c0e0bc0 tls: use optional chaining to simplify checks 
PR-URL: https://github.com/nodejs/node/pull/41337
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
 2022-01-05 11:01:29 +00:00
Shaw bad65ea69d http: remove duplicate code 
This line of code has been implemented in the prepareError function.

PR-URL: https://github.com/nodejs/node/pull/39239
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
 2022-01-04 19:55:40 -08:00
Robert Nagy 48e784043d stream: don't emit finish after destroy 
PR-URL: https://github.com/nodejs/node/pull/40852
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2022-01-03 16:32:44 +01:00
Darshan Sen 64cc066f59 timers: use ref counts to count timers 
The additional objects that were getting added and deleted from the
activeTimersMap object were slowing down the rest of the timers code,
so this change falls back to using the ref counts to count the active
timers inside process.getActiveResourcesInfo().

Fixes: https://github.com/nodejs/node/issues/41219

Signed-off-by: Darshan Sen <darshan.sen@postman.com>

PR-URL: https://github.com/nodejs/node/pull/41231
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-02 15:28:23 +00:00