BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity
35,457 Commits 266 Branches 972 Tags
ce41395f89414dfd459084ea61a7eeac1f67713a
Commit Graph
12723 Commits
Author SHA1 Message Date
Benjamin GruenbaumandAntoine du Hamel ce41395f89 test: add stream map tests 
Add more tests to check and enforce the behavior of the map method.

Co-Authored-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/41642
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-24 20:15:58 +02:00
Luigi Pinca 7ce8403ef1 test: simplify test-gc-http-client 
Instead of sending a fixed number of requests, detect when GC has
started and stop sending requests at that point.

PR-URL: https://github.com/nodejs/node/pull/41620
Refs: https://github.com/nodejs/node/commit/47ecf2060343
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2022-01-23 21:26:51 +01:00
Benjamin GruenbaumandRobert Nagy a8afe26fca stream: add drop and take 
This adds the `drop` and `take` methods to readable streams allowing
users easily drop and take items from the stream.

This continues the iterator-helper proposal alignment task.

Co-Authored-By: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/41630
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2022-01-23 18:43:16 +02:00
Benjamin Gruenbaum ca489497be stream: never flatten on toArray 
PR-URL: https://github.com/nodejs/node/pull/41615
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-23 08:19:53 +00:00
Benjamin GruenbaumandRobert Nagy cc8931a916 stream: support flatMap 
Support the `flatMap` method from the iterator helper TC39 proposal on
readable streams.

Co-Authored-By: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/41612
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2022-01-23 10:13:17 +02:00
Rich Trott d77754bfc7 test: prepare tests for no-cond-assign ESLint rule 
PR-URL: https://github.com/nodejs/node/pull/41614
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2022-01-22 19:38:17 -08:00
Luigi Pinca d01c645b9b test: move test-gc-http-client-onerror to sequential 
Fixes: https://github.com/nodejs/node/issues/41399

PR-URL: https://github.com/nodejs/node/pull/41619
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
 2022-01-22 19:32:40 +00:00
Tobias Nießen 18365d8ee6 crypto: change default check(Host|Email) behavior 
This changes the default behavior of the X509Certificate functions
checkHost and checkEmail to match the default behavior of OpenSSL's
X509_check_host and X509_check_email functions, respectively, which
is also what RFC 2818 mandates for HTTPS.

Refs: https://github.com/nodejs/node/pull/36804
Refs: https://github.com/nodejs/node/pull/41569

PR-URL: https://github.com/nodejs/node/pull/41600
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
 2022-01-22 18:36:47 +01:00
LiviaMedeiros b8de7aa4c2 crypto: adjust types for getRandomValues 
prevents Web Crypto API's getRandomValues from accepting DataView

Fixes: https://github.com/nodejs/node/issues/41480
Refs: https://www.w3.org/TR/WebCryptoAPI/#Crypto-method-getRandomValues

PR-URL: https://github.com/nodejs/node/pull/41481
Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Zeyu Yang <himself65@outlook.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2022-01-22 15:20:40 +01:00
Ray 2f1700463b readline: add feature yank and yank pop 
1. `Ctrl-Y` to yank previously deleted text
2. `Meta-Y` to do yank pop (cycle among deleted texts)
3. Use `getCursorPos().rows` to check if we have reached a new line,
instead of `getCursorPos().cols === 0`.
4. document and unittests.

PR-URL: https://github.com/nodejs/node/pull/41301
Fixes: https://github.com/nodejs/node/issues/41252
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>
 2022-01-22 05:42:48 +00:00
Tobias Nießen d0ea81c984 test: fix typo in test-stream-toArray 
Refs: https://github.com/nodejs/node/pull/41553

PR-URL: https://github.com/nodejs/node/pull/41634
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Mestery <mestery@protonmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2022-01-21 23:38:57 +00:00
Rich Trott 870044ffa1 tools: increase maximum line length to 120 characters 
PR-URL: https://github.com/nodejs/node/pull/41586
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Mestery <mestery@protonmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
 2022-01-21 15:28:07 +00:00
Ray 271725a363 readline: undo previous edit when get key code 0x1F 
1. Undo previous edit on keystroke `ctrl -` (emit 0x1F)
2. unittests
3. documentation

PR-URL: https://github.com/nodejs/node/pull/41392
Fixes: https://github.com/nodejs/node/issues/41308
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Qingyu Deng <i@ayase-lab.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-21 10:24:06 +00:00
Benjamin GruenbaumandRobert Nagy 5badf46f2a stream: support some and every 
This continues on the iterator-helpers work by adding `.some` and
`.every` to readable streams.

Co-Authored-By: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/41573
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2022-01-21 12:10:17 +02:00
Yoshiki Kurihara 10b043287c test: improve test coverage of internal/worker/io 
PR-URL: https://github.com/nodejs/node/pull/41511
Refs: https://coverage.nodejs.org/coverage-74b9baa4265a8f0d/lib/internal/worker/io.js.html#L415
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2022-01-20 22:41:45 +00:00
Benjamin GruenbaumandRobert Nagy 5a407d606a stream: add toArray 
Add the toArray method from the TC39 iterator helper proposal to
Readable streams. This also enables a common-use case of converting a
stream to an array.

Co-Authored-By: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/41553
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2022-01-20 11:24:29 +02:00
voltrexmaster de9dc417fe test: add DataView test entry for whatwg 
The WHATWG `ReadableStream` test needs a new test entry for reading a
`DataView`.

PR-URL: https://github.com/nodejs/node/pull/40622
Fixes: https://github.com/nodejs/node/issues/40612
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-20 09:19:38 +00:00
XadillaX 9759695545 lib: modify DOMException to pass WPT 
PR-URL: https://github.com/nodejs/node/pull/41517
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2022-01-20 13:45:54 +08:00
Rich Trott 25381da6b8 test: improve util-format code coverage 
Add test case for calling `util.format()` with a BigInt and a separator.

Refs: https://coverage.nodejs.org/coverage-986cf3b986c6c3e1/lib/internal/util/inspect.js.html#L2042

PR-URL: https://github.com/nodejs/node/pull/41572
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Mestery <mestery@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Zeyu Yang <himself65@outlook.com>
 2022-01-19 20:16:41 +00:00
Tobias Nießen da1b59fc13 crypto: support RFC 2818 compatible checkHost 
The 'subject' option should not only accept the values 'always' and
'never' because neither is compatible with RFC 2818, i.e., HTTPS. This
change adds a third value 'default', which implies the behavior that
HTTPS mandates.

The new 'default' case matches the default behavior of OpenSSL for both
DNS names and email addresses.

Future Node.js versions should change the default option value from
'always' to 'default'.

Refs: https://github.com/nodejs/node/pull/36804

PR-URL: https://github.com/nodejs/node/pull/41569
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2022-01-19 16:05:32 +01:00
Gang Chen 22792c8632 domain: pass opts to EventEmitter.init 
PR-URL: https://github.com/nodejs/node/pull/41414
Fixes: https://github.com/nodejs/node/issues/41391
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-19 11:26:38 +00:00
Jacob Smith dbc6e39ca7 esm: improve validation of resolved URLs 
PR-URL: https://github.com/nodejs/node/pull/41446
Reviewed-By: Bradley Farias <bradley.meck@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
 2022-01-19 05:28:32 +00:00
Tobias Nießen b9258e5e81 test: fix typo in test_js_native_api_v8 
PR-URL: https://github.com/nodejs/node/pull/41584
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Mestery <mestery@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-19 01:01:05 +01:00
Anatoli Papirovski 51783320a4 process: ignore asyncId 0 in exception handler 
Today, the global uncaught exception handler is the only
place where asyncId 0 is not ignored and we still proceed
to call emitAfter. This would've already failed one of
our correctness tests in async_hooks if not for some other
code meant to handle a different edge case.

Fixes: https://github.com/nodejs/node/issues/22982

PR-URL: https://github.com/nodejs/node/pull/41424
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2022-01-18 22:05:12 +01:00
Michael Dawson a199387f04 doc: make contributing info more discoverable 
There are been several discussions in recent PRs about
the docs related to contributing not being very discoverable.
Move these docs from doc/guides/ to doc/contributing.

Signed-off-by: Michael Dawson <mdawson@devrus.com>

PR-URL: https://github.com/nodejs/node/pull/41408
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is>
Reviewed-By: Mary Marchini <oss@mmarchini.me>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2022-01-18 14:24:30 -05:00
Tobias Nießen 65910c0d6c tls: represent registeredID numerically always 
Refs: https://github.com/nodejs/node/commit/466e5415a2b7b3574ab5403acb87e89a94a980d1

PR-URL: https://github.com/nodejs/node/pull/41561
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
 2022-01-18 20:00:18 +01:00
bencoe@google.com 6b9d2aefdb test: add missing await in fs-rm/fs-rmdir tests 
Noticed that a few assertions were not being awaited, this could
potentially be leading to flakiness in tmp cleanup.

Refs: #41201

PR-URL: https://github.com/nodejs/node/pull/41545
Refs: https://github.com/nodejs/node/issues/41201
Reviewed-By: Ian Sutherland <ian@iansutherland.ca>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Mestery <mestery@protonmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
 2022-01-17 15:27:19 -05:00
Rich Trott 8de858b96d test: increase coverage for stream writable 
Refs: https://github.com/nodejs/node/pull/41433#issuecomment-1009551922

PR-URL: https://github.com/nodejs/node/pull/41486
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2022-01-17 16:54:40 +00:00
Benjamin GruenbaumandRobert Nagy 3f0bcfb203 stream: add forEach method 
Add a `forEach` method to readable streams to enable concurrent
iteration and align with the iterator-helpers proposal.

Co-Authored-By: Robert Nagy <ronagy@icloud.com>
PR-URL: https://github.com/nodejs/node/pull/41445
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
 2022-01-17 14:25:04 +02:00
Rich Trott 0594577e69 test: add coverage for util.inspect() 
Coverage stats indicate that there is no coverage for util.inspect()
with a negative number and a numeric separator. Add a test case.

Refs: https://coverage.nodejs.org/coverage-df507758e6c35534/lib/internal/util/inspect.js.html#L1463

PR-URL: https://github.com/nodejs/node/pull/41527
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
 2022-01-16 21:37:45 -08:00
Tobias Nießen 807c7e14f4 tls: move tls.parseCertString to end-of-life 
The internal use of tls.parseCertString was removed in
a336444c7f. The function does not handle
multi-value RDNs correctly, leading to incorrect representations and
security concerns.

This change is breaking in two ways: tls.parseCertString is removed
(but has been runtime-deprecated since Node.js 9) and
_tls_common.translatePeerCertificate does not translate the `subject`
and `issuer` properties anymore.

This change also removes the recommendation to use querystring.parse
instead, which is similarly dangerous.

PR-URL: https://github.com/nodejs/node/pull/41479
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2022-01-15 17:00:25 +01:00
Yoshiki Kurihara 0f31d2993b test: improve test coverage of dns/promises 
PR-URL: https://github.com/nodejs/node/pull/41425
Refs: https://coverage.nodejs.org/coverage-0b4e9ae656e93e5f/lib/internal/dns/promises.js.html#L128
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2022-01-14 16:56:56 +00:00
Yoshiki Kurihara cd075f488a test: remove broken wiki link from test/common doc 
PR-URL: https://github.com/nodejs/node/pull/41426
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2022-01-14 17:53:45 +01:00
cjihrig e54f52f0dd test: do not OR F_OK in fs.access() test 
access() does not support OR'ing F_OK with other constants.
This commit updates test-fs-access.js to not test that
scenario.

PR-URL: https://github.com/nodejs/node/pull/41484
Refs: https://github.com/libuv/libuv/pull/3410
Reviewed-By: Richard Lau
Reviewed-By: Luigi Pinca
Reviewed-By: Tobias Nießen
 2022-01-14 11:46:52 -05:00
Rich Trott dcc368f4be tools,lib,test: enable ESLint no-regex-spaces rule 
PR-URL: https://github.com/nodejs/node/pull/41463
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2022-01-13 17:12:05 -08:00
Rich Trott 592f1845fa tools: enable ESLint require-yield rule 
PR-URL: https://github.com/nodejs/node/pull/41463
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2022-01-13 17:11:15 -08:00
Rich Trott 9bfe60fc20 tools: enable ESLint no-sparse-arrays rule 
PR-URL: https://github.com/nodejs/node/pull/41463
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2022-01-13 17:11:13 -08:00
Rich Trott 94abcbde8b tools: enable ESLint no-loss-of-precision rule 
PR-URL: https://github.com/nodejs/node/pull/41463
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2022-01-13 17:11:11 -08:00
Gang Chen 775bfd1579 esm: make process.exit() default to exit code 0 
Due to a bug in top-level await implementation, it used to default to
exit code 13.

PR-URL: https://github.com/nodejs/node/pull/41388
Fixes: https://github.com/nodejs/node/issues/40808
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
 2022-01-14 01:37:41 +01:00
Antonio Román 74b9baa426 v8: make writeHeapSnapshot throw if fopen fails 
If the file fails to be written (e.g. missing permissions, no space left
on device, etc), `writeHeapSnapshot` will now throw an exception.

This commit also adds error handling for the `fclose` call, returning
false if a non-zero value was returned.

Fixes: https://github.com/nodejs/node/issues/41346

PR-URL: https://github.com/nodejs/node/pull/41373
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2022-01-12 08:39:49 +00:00
XadillaX 38b7961ce6 url,lib: pass urlsearchparams-constructor.any.js 
According to WPT:

1. `URLSearchParams` constructor should throw exactly `TypeError` if any
   Error occurrs.
2. When a record passed to `URLSearchParams` constructor, two different
   key may result same after `toUVString()`. We should leave only the
   later one.

PR-URL: https://github.com/nodejs/node/pull/41197
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
 2022-01-11 18:29:31 +08:00
Tobias Nießen 3454e79713 console: fix prototype pollution via console.table 
CVE-ID: CVE-2022-21824
PR-URL: https://github.com/nodejs-private/node-private/pull/307
Refs: https://hackerone.com/reports/1431042
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2022-01-10 22:38:05 +00:00
Tobias Nießen a336444c7f tls: fix handling of x509 subject and issuer 
When subject and verifier are represented as strings, escape special
characters (such as '+') to guarantee unambiguity. Previously, different
distinguished names could result in the same string when encoded. In
particular, inserting a '+' in a single-value Relative Distinguished
Name (e.g., L or OU) would produce a string that is indistinguishable
from a multi-value Relative Distinguished Name. Third-party code that
correctly interprets the generated string representation as a
multi-value Relative Distinguished Name could then be vulnerable to an
injection attack, e.g., when an attacker includes a single-value RDN
with type OU and value 'HR + CN=example.com', the string representation
produced by unpatched versions of Node.js would be
'OU=HR + CN=example.com', which represents a multi-value RDN.

Node.js itself is not vulnerable to this attack because the current
implementation that parses such strings into objects does not handle '+'
at all. This oversight leads to incorrect results, but at the same time
appears to prevent injection attacks (as described above).

With this change, the JavaScript objects representing the subject and
issuer Relative Distinguished Names are constructed in C++ directly,
instead of (incorrectly) encoding them as strings and then (incorrectly)
decoding the strings in JavaScript.

This addresses CVE-2021-44533.

CVE-ID: CVE-2021-44533
PR-URL: https://github.com/nodejs-private/node-private/pull/300
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2022-01-10 22:38:05 +00:00
Tobias Nießen 50439b446f tls: drop support for URI alternative names 
Previously, Node.js incorrectly accepted uniformResourceIdentifier (URI)
subject alternative names in checkServerIdentity regardless of the
application protocol. This was incorrect even in the most common cases.
For example, RFC 2818 specifies (and RFC 6125 confirms) that HTTP over
TLS only uses dNSName and iPAddress subject alternative names, but not
uniformResourceIdentifier subject alternative names.

Additionally, name constrained certificate authorities might not be
constrained to specific URIs, allowing them to issue certificates for
URIs that specify hosts that they would not be allowed to issue dNSName
certificates for.

Even for application protocols that make use of URI subject alternative
names (such as SIP, see RFC 5922), Node.js did not implement the
required checks correctly, for example, because checkServerIdentity
ignores the URI scheme.

As a side effect, this also fixes an edge case. When a hostname is not
an IP address and no dNSName subject alternative name exists, the
subject's Common Name should be considered even when an iPAddress
subject alternative name exists.

It remains possible for users to pass a custom checkServerIdentity
function to the TLS implementation in order to implement custom identity
verification logic.

This addresses CVE-2021-44531.

CVE-ID: CVE-2021-44531
PR-URL: https://github.com/nodejs-private/node-private/pull/300
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2022-01-10 22:38:05 +00:00
Tobias Nießen 466e5415a2 crypto,tls: implement safe x509 GeneralName format 
This change introduces JSON-compatible escaping rules for strings that
include X.509 GeneralName components (see RFC 5280). This non-standard
format avoids ambiguities and prevents injection attacks that could
previously lead to X.509 certificates being accepted even though they
were not valid for the target hostname.

These changes affect the format of subject alternative names and the
format of authority information access. The checkServerIdentity function
has been modified to safely handle the new format, eliminating the
possibility of injecting subject alternative names into the verification
logic.

Because each subject alternative name is only encoded as a JSON string
literal if necessary for security purposes, this change will only be
visible in rare cases.

This addresses CVE-2021-44532.

CVE-ID: CVE-2021-44532
PR-URL: https://github.com/nodejs-private/node-private/pull/300
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
 2022-01-10 22:38:05 +00:00
Colin Ihrig b6b6510187 deps: upgrade to libuv 1.43.0 
Notable changes:

- `uv_ip_name()` has been added.
- On Windows, `uv_fs_read()` and `uv_fs_write()` now return
  `UV_EBADF` instead of `UV_EPERM` when the file descriptor
  was opened with incorrect flags. This matches the behavior
  on other platforms.
- Streams can be reset and attempted to read from after
  EOF is read.
- The main thread now has a valid ID instead of `NULL`.
- `uv_cpu_info()` now supports `aarch64`.
- Several minor issues related to mingw32 have been fixed.

PR-URL: https://github.com/nodejs/node/pull/41398
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2022-01-07 02:45:31 +00:00
Geoffrey Booth 8dd0658e87 esm: refactor esm tests out of test/message 
PR-URL: https://github.com/nodejs/node/pull/41352
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
 2022-01-06 11:07:52 +00:00
Michael Dawson 0b4e9ae656 test: mark test-performance-eventloopdelay flaky 
Refs: https://github.com/nodejs/node/issues/41286

This is one of the remaining high indicende failures
in the CI. Mark as flaky while it is investigated.

Signed-off-by: Michael Dawson <mdawson@devrus.com>

PR-URL: https://github.com/nodejs/node/pull/41409
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2022-01-06 01:14:28 +00:00
Rich Trott 55ceaec111 tools,benchmark,lib,test: enable no-case-declarations lint rule 
PR-URL: https://github.com/nodejs/node/pull/41385
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Tierney Cyren <hello@bnb.im>
Reviewed-By: Ricky Zhou <0x19951125@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2022-01-05 07:42:19 -08:00
Michael Dawson c85e67b600 test: mark test-repl-sigint-nested-eval as flaky 
Refs: https://github.com/nodejs/node/issues/41123

- This is one of the remaining high occurance flaky
  tests from the reliability reports and recent
  failures in the CI. Mark as flaky until issue
  is resolved under referenced issue.

Signed-off-by: Michael Dawson <mdawson@devrus.com>

PR-URL: https://github.com/nodejs/node/pull/41302
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2022-01-04 15:59:25 -05:00