Files
node/doc
Tobias Nießen 4a82c8fda0 doc,test: clarify behavior of DH generateKeys
The DiffieHellman class is an old and thin wrapper around certain
OpenSSL functions, many of which are deprecated in OpenSSL 3.0. Because
the Node.js API mirrors the OpenSSL API, it adopts some of its
peculiarities, but the Node.js documentation does not properly reflect
these. Most importantly, despite the documentation saying otherwise,
diffieHellman.generateKeys() does not generate a new private key when
one has already been set or generated. Based on the documentation alone,
users may be led to misuse the API in a way that results in key reuse,
which can have drastic negative consequences for subsequent operations
that consume the shared secret.

These design issues in this old API have been around for many years, and
we are not currently aware of any misuse in the ecosystem that falls
into the above scenario. Changing the behavior of the API would be a
significant breaking change and is thus not appropriate for a security
release (nor is it a goal.) The reported issue is treated as CWE-1068
(after a vast amount of uncertainty whether to treat it as a
vulnerability at all), therefore, this change only updates the
documentation to match the actual behavior. Tests are also added that
demonstrate this particular oddity.

Newer APIs exist that can be used for some, but not all, Diffie-Hellman
operations (e.g., crypto.diffieHellman() that was added in 2020). We
should keep modernizing crypto APIs, but that is a non-goal for this
security release.

The ECDH class mirrors the DiffieHellman class in many ways, but it does
not appear to be affected by this particular peculiarity. In particular,
ecdh.generateKeys() does appear to always generate a new private key.

PR-URL: https://github.com/nodejs-private/node-private/pull/426
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
CVE-ID: CVE-2023-30590
2023-06-20 17:30:34 -03:00
..
2022-03-18 15:29:10 -04:00

Documentation style guide

This style guide helps us create organized and easy-to-read documentation. It provides guidelines for organization, spelling, formatting, and more.

These are guidelines rather than strict rules. Content is more important than formatting. You do not need to learn the entire style guide before contributing to documentation. Someone can always edit your material later to conform with this guide.

  • Documentation is in markdown files with names formatted as lowercase-with-dashes.md.
    • Use an underscore in the filename only if the underscore is part of the topic name (e.g., child_process).
    • Some files, such as top-level markdown files, are exceptions.
  • Documents should be word-wrapped at 80 characters.
  • .editorconfig describes the preferred formatting.
    • A plugin is available for some editors to apply these rules.
  • Check changes to documentation with make test-doc -j or vcbuild test-doc.
  • Use US spelling.
  • Use serial commas.
  • Avoid first-person pronouns (I, we).
    • Exception: we recommend foo is preferable to foo is recommended.
  • Use gender-neutral pronouns and gender-neutral plural nouns.
    • OK: they, their, them, folks, people, developers
    • NOT OK: his, hers, him, her, guys, dudes
  • When combining wrapping elements (parentheses and quotes), place terminal punctuation:
    • Inside the wrapping element if the wrapping element contains a complete clause.
    • Outside of the wrapping element if the wrapping element contains only a fragment of a clause.
  • Documents must start with a level-one heading.
  • Prefer affixing links ([a link][]) to inlining links ([a link](http://example.com)).
  • When documenting APIs, update the YAML comment associated with the API as appropriate. This is especially true when introducing or deprecating an API.
  • When documenting APIs, every function should have a usage example or link to an example that uses the function.
  • For code blocks:
    • Use language-aware fences. (```js)

    • For the info string, use one of the following.

      Meaning Info string
      Bash bash
      C c
      C++ cpp
      CoffeeScript coffee
      Diff diff
      HTTP http
      JavaScript js
      JSON json
      Markdown markdown
      Plaintext text
      Powershell powershell
      R r
      Shell Session console

      If one of your language-aware fences needs an info string that is not already on this list, you may use text until the grammar gets added to remark-preset-lint-node.

    • Code need not be complete. Treat code blocks as an illustration or aid to your point, not as complete running programs. If a complete running program is necessary, include it as an asset in assets/code-examples and link to it.

  • When using underscores, asterisks, and backticks, please use backslash-escaping: \_, \*, and \` .
  • Constructors should use PascalCase.
  • Instances should use camelCase.
  • Denote methods with parentheses: socket.end() instead of socket.end.
  • Function arguments or object properties should use the following format:
    • * `name` {type|type2} Optional description. **Default:** `value`.
    • For example: * byteOffset {integer} Index of first byte to expose. Default: 0.
  • Function returns should use the following format:
    • * Returns: {type|type2} Optional description.
    • E.g. * Returns: {AsyncHook} A reference to asyncHook.
  • Use official styling for capitalization in products and projects.
    • OK: JavaScript, Google's V8
    • NOT OK: Javascript, Google's v8
  • Use Node.js and not Node, NodeJS, or similar variants.
    • When referring to the executable, node is acceptable.
  • Be direct.
  • When referring to a version of Node.js in prose, use Node.js and the version number. Do not prefix the version number with v in prose. This is to avoid confusion about whether v8 refers to Node.js 8.x or the V8 JavaScript engine.
    • OK: Node.js 14.x, Node.js 14.3.1
    • NOT OK: Node.js v14
  • Use sentence-style capitalization for headings.

See also API documentation structure overview in doctools README.

For topics not covered here, refer to the Microsoft Writing Style Guide.