0
0
mirror of https://github.com/nodejs/node.git synced 2024-12-01 16:10:02 +01:00
Commit Graph

15181 Commits

Author SHA1 Message Date
Brian White
13481d07f5 inspector: fix minor issues
PR-URL: https://github.com/nodejs/node/pull/8890
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
2016-10-03 12:39:17 +02:00
Brian White
9eb61793bf cluster: remove unused backlog argument
PR-URL: https://github.com/nodejs/node/pull/8877
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
2016-10-03 12:34:46 +02:00
Franziska Hinkelmann
c32cfcbe39 src: refactor reading of options in contextify
Refactor various functions that read values from the contextify
options object.  Rather than passing args and the index, pass the
value at that index.

We use env->isolate() rather than args.GetIsolate(), but since env
was constructed from args, this is the same isolate.

PR-URL: https://github.com/nodejs/node/pull/8850
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-10-03 12:25:09 +02:00
Rich Trott
b5ec47e941 test: clean up test-timers-immediate
Clean up test-timers-immediate. Use of `let` also requires a tweak to
ESLint rules (but it's one that we should do as timers is pretty much
the reason it exists).

PR-URL: https://github.com/nodejs/node/pull/8857
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2016-10-02 20:40:51 -07:00
Daniel Stenberg
68c4c71f7f ares_create_query: avoid single-byte buffer overwrite
Incorrect string length calculation when passing escaped dot.

- CVE: CVE-2016-5180
- Upstream bug: https://c-ares.haxx.se/adv_20160929.html

PR-URL: https://github.com/nodejs/node/pull/8849
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
2016-10-02 20:40:48 -03:00
Daniel Bevenius
3c5cf12709 test: add and assert readable/writable arguments
Currently the readable and writable arguments are not specified in the
req.oncomplete method. Adding and asserting that they are always true
(which is always the case for TCP). This might seem unnecessary but it
can't hurt to have them to pickup any breaking modifications made to
ConnectionWrap::AfterConnect in the future.

PR-URL: https://github.com/nodejs/node/pull/8815
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-10-02 07:09:18 +02:00
Brian White
c8c2544cd9
timers: improve setTimeout/Interval performance
This commit improves timers performance by making functions
inlineable and avoiding the creation of extra closures/functions.

This commit also makes setTimeout/Interval argument handling
consistent with that of setImmediate.

These changes give ~22% improvement in the existing 'breadth' timers
benchmark.

PR-URL: https://github.com/nodejs/node/pull/8661
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
2016-10-01 02:58:42 -04:00
Mike Woods
f5d997c476 test: cleanup/update test-os.js
Replaced `==` with `===
Replaced `indexOf(...) !== -1` with `includes()`

PR-URL: https://github.com/nodejs/node/pull/8761
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
2016-09-30 10:57:19 -07:00
Madhav Gharmalkar
4c61f57f1b src: fixes misplaced comment
In e26622b, a comment was incorrectly moved from the code
it was describing.

Fixes: https://github.com/nodejs/node/issues/8856
PR-URL: https://github.com/nodejs/node/pull/8860
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
2016-09-30 09:47:09 -07:00
Daniel Bevenius
6e62b71688 src: add missing length argument to send comment
The list.length argument is missing from the comment and just adding
this for clarity.

PR-URL: https://github.com/nodejs/node/pull/8816
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
2016-09-30 09:35:36 -07:00
Lydia Kats
b838e5ff86 test: modernize syntax, add strict checks
Changed `var` to `const`, strings to template literals, and
assert.equal to assert.strictEqual where appropriate.

PR-URL: https://github.com/nodejs/node/pull/8841
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
2016-09-30 12:18:55 -04:00
Lydia Kats
cd5a4c157c test: use common.skip for tap skip output
These were missed from 52bae222a3

PR-URL: https://github.com/nodejs/node/pull/8841
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
2016-09-30 12:18:55 -04:00
Italo A. Casas
5e6bd84ff0
test: stream writable ended state
PR-URL: https://github.com/nodejs/node/pull/8778
Ref: https://github.com/nodejs/node/issues/8686
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-09-30 18:12:18 +02:00
Franziska Hinkelmann
bdb801261a doc: add example for running with v8-inspector
Add example to show what running Node.js with `--inspect`
should look like.

Some IDEs do not show the link when running with `--inspect`.
This example hints to what the full output looks like.

PR-URL: https://github.com/nodejs/node/pull/8845
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
2016-09-30 08:39:50 -07:00
Bartosz Sosnowski
3e7da1d7a2 benchmark: add info about required Unix tools
This adds note to README.md about Unix tools being
required by some benchmarks

PR-URL: https://github.com/nodejs/node/pull/8788
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2016-09-30 08:24:16 -07:00
Franziska Hinkelmann
21b37b23c1 doc: fix typo in repl doc
PR-URL: https://github.com/nodejs/node/pull/8826
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Yorkie Liu <yorkiefixer@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2016-09-30 07:58:34 -07:00
Anna Henningsen
c084287a60
fs,module: add module-loader-only realpath cache
Reintroduce a realpath cache with the same mechanisms which existed
before b488b19eaf
(`fs: optimize realpath using uv_fs_realpath()`), but only for
the synchronous version and with the cache being passed as a
hidden option to make sure it is only used internally.

The cache is hidden from userland applications because it has been
decided that fully reintroducing as part of the public API might stand
in the way of future optimizations.

PR-URL: https://github.com/nodejs/node/pull/8100
Reviewed-By: Bartosz Sosnowski <bartosz@janeasystems.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-09-30 16:01:59 +02:00
yorkie
7bc6aeac86 dns: remove internal variable from makeAsync
PR-URL: https://github.com/nodejs/node/pull/8800
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2016-09-30 10:02:39 +08:00
Italo A. Casas
560a589e75 stream: improve stream error messages
Improve message when tranform._transform() method is not implemented
Improve error message when Readable._read() is not implemented
Remove extra word in err msg when Writable._write() when not implemented
Remove extra word in err msg when Transform._transform() when not implemented

PR-URL: https://github.com/nodejs/node/pull/8801
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
2016-09-29 23:06:51 +03:00
Rich Trott
33dd4ec645 test: mark test-inspector flaky on windows
PR-URL: https://github.com/nodejs/node/pull/8835
Reviewed-By: Eugene Ostroukhov <eostroukhov@google.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
2016-09-29 11:56:41 -04:00
Myles Borins
b5bdff876b src: update NODE_MODULE_VERSION to 51
When V8 was updated on master to 5.4 there were ABI breaking changes.
In the past we have not landed these types of changes before a release,
and as such have only bumped the NODE_MODULE_VERSION number in the
release commit.

Since we are going to be keeping the V8 5.4 beta on master and in the
v7 betas I think it makes sense for us to bump the module number prior
to a release commit being made. It is possible that this commit should
be reverted prior to v7.0.0 being cut. Alternatively we may want to
modify our release process for V8 to include a NODE_MODULE_VERSION
bump before landing on master when applicable.

NODE_MODULE_VERSION is being bumped to 51 instead of 49 to avoid
conflicts with NODE_MODULE_VERSIONs being used in electron.

Ref: https://github.com/electron/electron/issues/5851#issuecomment-246920775
Ref: https://github.com/nodejs/node/pull/8317

PR-URL: https://github.com/nodejs/node/pull/8808
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2016-09-29 11:50:31 -04:00
Jeremiah Senkpiel
e758bd541b test: clean up test-buffer-badhex
This test was recently (at the time of writing) introduced in
151d316b99
and could be cleaned up a bit.

Refs: https://github.com/nodejs/node/pull/7602
PR-URL: https://github.com/nodejs/node/pull/7773
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-09-29 09:54:09 -04:00
Anna Henningsen
72c60e892c
src: notify V8 for low memory when alloc fails
Call `v8::Isolate::GetCurrent()->LowMemoryNotification()` when
an allocation fails to give V8 a chance to clean up and return
memory before retrying (and possibly giving up).

PR-URL: https://github.com/nodejs/node/pull/8482
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
2016-09-29 09:46:42 +02:00
Anna Henningsen
ea94086ad2
src: provide allocation + nullptr check shortcuts
Provide shortcut `node::CheckedMalloc()` and friends that
replace `node::Malloc()` + `CHECK_NE(·, nullptr);` combinations
in a few places.

PR-URL: https://github.com/nodejs/node/pull/8482
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
2016-09-29 09:46:42 +02:00
Anna Henningsen
48ed65440c
src: pass desired return type to allocators
Pass the desired return type directly to the allocation functions,
so that the resulting `static_cast` from `void*` becomes unneccessary
and the return type can be use as a reasonable default value for the
`size` parameter.

PR-URL: https://github.com/nodejs/node/pull/8482
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
2016-09-29 09:46:42 +02:00
Anna Henningsen
eb927fac38
src: add Malloc() size param + overflow detection
Adds an optional second parameter to `node::Malloc()` and
an optional third parameter to `node::Realloc()` giving the
size/number of items to be allocated, in the style of `calloc(3)`.

Use a proper overflow check using division;
the previous `CHECK_GE(n * size, n);` would not detect all cases
of overflow (e.g. `size == SIZE_MAX / 2 && n == 3`).

PR-URL: https://github.com/nodejs/node/pull/8482
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
2016-09-29 09:46:42 +02:00
Akito Ito
506cda6ea6 test: cleanup test-net-server-address.js
Refactored test:
- 'var' to 'const'
- functon to arrow function
- using common.mustCall() and common.fail()

PR-URL: https://github.com/nodejs/node/pull/8586
Reviewed-By: Yosuke Furukawa <yosuke.furukawa@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-09-29 10:37:54 +03:00
Luigi Pinca
a4d396d858 doc: improve documentation for commit subject line
Specify that commit subject line must be made of only lowercase words
and should start with an imperative verb.

PR-URL: https://github.com/nodejs/node/pull/8546
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
2016-09-29 08:34:18 +02:00
Rich Trott
cad0423ce4 doc: encourage 2FA before onboarding
In the onboarding document, add a note to ask the new Collaborator if
they are using two-factor authentication on their GitHub account. If
they are not, suggest that they enable it as their account will have
elevated privileges in many of the Node.js repositories.

PR-URL: https://github.com/nodejs/node/pull/8776
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Johan Bergstrom <bugs@bergstroem.nu>
Reviewed-By: Robert Jefe Lindstaedt <robert.lindstaedt@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-09-28 17:23:22 -07:00
Rich Trott
676e624eb3 doc: add optional step to onboarding doc
Include information on how to force push to the contributor's own branch
so that pull requests show as merged in GitHub interface.

PR-URL: https://github.com/nodejs/node/pull/8774
Reviewed-By: Robert Jefe Lindstaedt <robert.lindstaedt@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Johan Bergstrom <bugs@bergstroem.nu>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-09-28 17:20:16 -07:00
Richard Hong
8cd2306cc3 test:replace indexOf, assert.equal, add mustCall()
replace indexOf with includes
replace assert.equal with assert.strictEqual
add common.mustCall
replace throw error with assert.ifError

PR-URL: https://github.com/nodejs/node/pull/8766
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
2016-09-28 14:34:14 -07:00
Christopher Fujino
7f7502d901 doc: remove failing workaround in BUILDING.md
Updated BUILDING.md, removing workaround for Python conflicts that
didn't work.

PR-URL: https://github.com/nodejs/node/pull/8763
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Bryan English <bryan@bryanenglish.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Refs: https://github.com/nodejs/node/pull/8763
2016-09-28 10:27:54 -07:00
Ben Noordhuis
c991d6465c src: rename CHECK_NOT_OOB() macro
Rename CHECK_NOT_OOB() to THROW_AND_RETURN_IF_OOB() because the old name
suggests it asserts and aborts when it is really a control flow macro.

PR-URL: https://github.com/nodejs/node/pull/8784
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
2016-09-28 11:02:40 +02:00
Сковорода Никита Андреевич
495d688e06 buffer: zero-fill uninitialized bytes in .concat()
This makes sure that no uninitialized bytes are leaked when the specified
`totalLength` input value is greater than the actual total length of the
specified buffers array, e.g. in Buffer.concat([Buffer.alloc(0)], 100).

PR-URL: https://github.com/nodejs/node-private/pull/64
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2016-09-28 11:19:18 +10:00
Ben Noordhuis
c34e58e684 lib: make tls.checkServerIdentity() more strict
PR-URL: https://github.com/nodejs/node-private/pull/75
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-09-28 11:19:18 +10:00
Ben Noordhuis
6023ba114a crypto: don't build hardware engines
Compile out hardware engines.  Most are stubs that dynamically load
the real driver but that poses a security liability when an attacker
is able to create a malicious DLL in one of the default search paths.

PR-URL: https://github.com/nodejs/node-private/pull/73
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
2016-09-28 11:19:18 +10:00
Evan Lucas
ca5f8f80e3 http: check reason chars in writeHead
Previously, the reason argument passed to ServerResponse#writeHead was
not being properly validated.  One could pass CRLFs which could lead to
http response splitting. This commit changes the behavior to throw an
error in the event any invalid characters are included in the reason.

CVE-2016-5325

PR-URL: https://github.com/nodejs/node-private/pull/60
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
2016-09-28 11:19:18 +10:00
yorkie
f4d7abf3bc tls: improve createSecureContext in _tls_common
- this shares the iterator variable `i` expictly.
- this converts some var to const.

PR-URL: https://github.com/nodejs/node/pull/8781
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-09-28 09:15:27 +08:00
Evan Lucas
aae1862385 2016-09-27, Version 6.7.0 (Current)
This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable Changes

Semver Minor:

* openssl:
  - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
    CVE-2016-6304 ("OCSP Status Request extension unbounded memory
    growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
    (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8714
  - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
    a crash when using CRLs, CVE-2016-7052.
    (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8786
  - Remove support for loading dynamic third-party engine modules.
    An attacker may be able to hide malicious code to be inserted
    into Node.js at runtime by masquerading as one of the dynamic
    engine modules. Originally reported by Ahmed Zaki (Skype).
    (Ben Noordhuis) https://github.com/nodejs/node-private/pull/73
* http: CVE-2016-5325 - Properly validate for allowable characters in
  the `reason` argument in `ServerResponse#writeHead()`. Fixes a
  possible response splitting attack vector. This introduces a new
  case where `throw` may occur when configuring HTTP responses, users
  should already be adopting try/catch here. Originally reported
  independently by Evan Lucas and Romain Gaucher.
  (Evan Lucas) https://github.com/nodejs/node-private/pull/60

Semver Patch:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
  `Buffer.concat()` while providing a `totalLength` parameter that
  exceeds the total length of the original `Buffer` objects being
  concatenated.
  (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/64
* src: Fix regression where passing an empty password and/or salt to
  crypto.pbkdf2() would cause a fatal error
  (Rich Trott) https://github.com/nodejs/node/pull/8572
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
  check whereby a TLS server may be able to serve an invalid wildcard
  certificate for its hostname due to improper validation of `*.` in the
  wildcard string. Originally reported by Alexander Minozhenko and
  James Bunton (Atlassian).
  (Ben Noordhuis) https://github.com/nodejs/node-private/pull/75
* v8: Fix regression where a regex on a frozen object was broken
  (Myles Borins) https://github.com/nodejs/node/pull/8673
2016-09-27 19:45:55 -05:00
Rod Vagg
eba39c4bc6 2016-09-27, Version 4.6.0 'Argon' (LTS)
This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable Changes

Semver Minor:

* openssl:
  - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
    CVE-2016-6304 ("OCSP Status Request extension unbounded memory
    growth", high severity), CVE-2016-2183, CVE-2016-6303,
    CVE-2016-2178 and CVE-2016-6306.
    (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8714
  - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
    a crash when using CRLs, CVE-2016-7052.
    (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8786
  - Remove support for loading dynamic third-party engine modules.
    An attacker may be able to hide malicious code to be inserted into
    Node.js at runtime by masquerading as one of the dynamic engine
    modules. Originally reported by Ahmed Zaki (Skype).
    (Ben Noordhuis) https://github.com/nodejs/node-private/pull/70
* http: CVE-2016-5325 - Properly validate for allowable characters in
  the `reason` argument in `ServerResponse#writeHead()`. Fixes a
  possible response splitting attack vector. This introduces a new
  case where `throw` may occur when configuring HTTP responses, users
  should already be adopting try/catch here. Originally reported
  independently by Evan Lucas and Romain Gaucher.
  (Evan Lucas) https://github.com/nodejs/node-private/pull/46

Semver Patch:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
  `Buffer.concat()` while providing a `totalLength` parameter that
  exceeds the total length of the original `Buffer` objects being
  concatenated.
  (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/65
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
  check whereby a TLS server may be able to serve an invalid wildcard
  certificate for its hostname due to improper validation of `*.` in
  the wildcard string. Originally reported by Alexander Minozhenko and
  James Bunton (Atlassian).
  (Ben Noordhuis) https://github.com/nodejs/node-private/pull/63

PR-URL: https://github.com/nodejs/node-private/pull/74
2016-09-28 10:42:18 +10:00
Rod Vagg
e686be90bb 2016-09-27 Version 0.12.16 (Maintenance) Release
This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable changes:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
  `Buffer.concat()` while providing a `totalLength` parameter that
  exceeds the total length of the original `Buffer` objects being
  concatenated. (Сковорода Никита Андреевич)
* http:
  - CVE-2016-5325 - Properly validate for allowable characters in the
    `reason` argument in `ServerResponse#writeHead()`. Fixes a
    possible response splitting attack vector. This introduces a new
    case where `throw` may occur when configuring HTTP responses,
    users should already be adopting try/catch here. Originally
    reported independently by Evan Lucas and Romain Gaucher.
    (Evan Lucas)
  - Invalid status codes can no longer be sent. Limited to 3 digit
    numbers between 100 - 999. Lack of proper validation may also
    serve as a potential response splitting attack vector. Backported
    from v4.x. (Brian White)
* openssl:
  - Upgrade to 1.0.1u, fixes a number of defects impacting Node.js:
    CVE-2016-6304 ("OCSP Status Request extension unbounded memory
    growth", high severity), CVE-2016-2183, CVE-2016-6303,
    CVE-2016-2178 and CVE-2016-6306.
  - Remove support for loading dynamic third-party engine modules.
    An attacker may be able to hide malicious code to be inserted
    into Node.js at runtime by masquerading as one of the dynamic
    engine modules. Originally reported by Ahmed Zaki (Skype).
    (Ben Noordhuis, Rod Vagg)
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
  check whereby a TLS server may be able to serve an invalid wildcard
  certificate for its hostname due to improper validation of `*.` in
  the wildcard string. Originally reported by Alexander Minozhenko
  and James Bunton (Atlassian). (Ben Noordhuis)

PR-URL: https://github.com/nodejs/node-private/pull/72
2016-09-28 10:38:33 +10:00
Rod Vagg
f5ee3fe10e 2016-09-27 Version 0.10.47 (Maintenance) Release
This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable changes:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
  `Buffer.concat()` while providing a `totalLength` parameter that
  exceeds the total length of the original `Buffer` objects being
  concatenated. (Сковорода Никита Андреевич)
* http:
  - CVE-2016-5325 - Properly validate for allowable characters in the
    `reason` argument in `ServerResponse#writeHead()`. Fixes a
    possible response splitting attack vector. This introduces a new
    case where `throw` may occur when configuring HTTP responses,
    users should already be adopting try/catch here. Originally
    reported independently by Evan Lucas and Romain Gaucher.
    (Evan Lucas)
  - Invalid status codes can no longer be sent. Limited to 3 digit
    numbers between 100 - 999. Lack of proper validation may also
    serve as a potential response splitting attack vector. Backported
    from v4.x. (Brian White)
* openssl: Upgrade to 1.0.1u, fixes a number of defects impacting
  Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded
  memory growth", high severity), CVE-2016-2183, CVE-2016-6303,
  CVE-2016-2178 and CVE-2016-6306.
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
  check whereby a TLS server may be able to serve an invalid wildcard
  certificate for its hostname due to improper validation of `*.` in
  the wildcard string. Originally reported by Alexander Minozhenko
  and James Bunton (Atlassian). (Ben Noordhuis)

PR-URL: https://github.com/nodejs/node-private/pull/71
2016-09-28 10:35:20 +10:00
fen
23e1ed7282 doc: add commit formats for release blog posts
this commit enhances the guidelines to creating a release blog post, specifically by adding
a commit format that must be adhered to when creating a pull request on the website repository

Fixes: https://github.com/nodejs/node/issues/8629

PR-URL: https://github.com/nodejs/node/pull/8631
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: James M Snell <jasnell@keybase.io>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
2016-09-27 18:16:24 -04:00
Kat Marchán
6b443d1731 deps: hotfix upgrade npm tap version for tests
PR-URL: https://github.com/nodejs/node/pull/8706
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
2016-09-27 16:41:01 -04:00
Kat Marchán
d44a9eb11b deps: upgrade npm to 3.10.8
PR-URL: https://github.com/nodejs/node/pull/8706
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
2016-09-27 16:39:27 -04:00
yorkie
33aa953f91 doc: fix title level at tls.md
PR-URL: https://github.com/nodejs/node/pull/8782
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Teddy Katz <teddy.katz@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
2016-09-27 07:59:49 -07:00
Marc-Aurèle DARCHE
bb78f657b4 doc: add added: info for crypto.timingSafeEqual()
crypto.timingSafeEqual() has been added in v6.6.0 cf. #8304

This commit adds the metadata that will display
"Added in: v6.6.0" and that can later be checked on
https://nodejs.org/api/crypto.html#crypto_crypto_timingsafeequal_a_b

PR-URL: https://github.com/nodejs/node/pull/8796
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Teddy Katz <teddy.katz@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
2016-09-27 07:43:13 -07:00
Сковорода Никита Андреевич
bedc6b6247 doc: enable no-file-name-articles remark-lint rule
This renames doc/topics/the-event-loop-timers-and-nexttick.md to
doc/topics/event-loop-timers-and-nexttick.md, which looks like a
better name for that file and enables no-file-name-articles remark-lint
rule to prevent such names in the future.

PR-URL: https://github.com/nodejs/node/pull/8713
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-09-27 07:07:40 -07:00
Alfred Cepeda
8e81e91c55 test: fixed FIXME in test-repl-persistent-history
When NODE_REPL_HISTORY isn't defined `repl` defaults to temporary file
This prevents the temporary file from being cleared and removes check
on fixture

Refs: https://github.com/nodejs/node/issues/4640
PR-URL: https://github.com/nodejs/node/pull/8756
Reviewed-By: Ilkka Myller <ilkka.myller@nodefield.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
2016-09-27 10:00:31 -04:00
Matt Lang
7561123a9f test: update var to const, use arrow functions
PR-URL: https://github.com/nodejs/node/pull/8595
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2016-09-27 06:39:31 -07:00