From 255bc945c2bad35c01b65e3351337e30372907b4 Mon Sep 17 00:00:00 2001 From: Bert Belder Date: Thu, 7 Feb 2013 14:39:47 +0100 Subject: [PATCH 01/15] http: protect against response splitting attacks This patch is a back-port of 3c293ba. Closes #4696 --- lib/http.js | 5 ++ .../test-http-header-response-splitting.js | 64 +++++++++++++++++++ 2 files changed, 69 insertions(+) create mode 100644 test/simple/test-http-header-response-splitting.js diff --git a/lib/http.js b/lib/http.js index aee579aadf..315a9c6a24 100644 --- a/lib/http.js +++ b/lib/http.js @@ -546,6 +546,11 @@ OutgoingMessage.prototype._storeHeader = function(firstLine, headers) { var self = this; function store(field, value) { + // Protect against response splitting. The if statement is there to + // minimize the performance impact in the common case. + if (/[\r\n]/.test(value)) + value = value.replace(/[\r\n]+[ \t]*/g, ''); + messageHeader += field + ': ' + value + CRLF; if (connectionExpression.test(field)) { diff --git a/test/simple/test-http-header-response-splitting.js b/test/simple/test-http-header-response-splitting.js new file mode 100644 index 0000000000..044618436c --- /dev/null +++ b/test/simple/test-http-header-response-splitting.js @@ -0,0 +1,64 @@ +// Copyright Joyent, Inc. and other Node contributors. +// +// Permission is hereby granted, free of charge, to any person obtaining a +// copy of this software and associated documentation files (the +// "Software"), to deal in the Software without restriction, including +// without limitation the rights to use, copy, modify, merge, publish, +// distribute, sublicense, and/or sell copies of the Software, and to permit +// persons to whom the Software is furnished to do so, subject to the +// following conditions: +// +// The above copyright notice and this permission notice shall be included +// in all copies or substantial portions of the Software. +// +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS +// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN +// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, +// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR +// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE +// USE OR OTHER DEALINGS IN THE SOFTWARE. + +var common = require('../common'), + assert = require('assert'), + http = require('http'); + +var testIndex = 0, + responses = 0; + +var server = http.createServer(function(req, res) { + switch (testIndex++) { + case 0: + res.writeHead(200, { test: 'foo \r\ninvalid: bar' }); + break; + case 1: + res.writeHead(200, { test: 'foo \ninvalid: bar' }); + break; + case 2: + res.writeHead(200, { test: 'foo \rinvalid: bar' }); + break; + case 3: + res.writeHead(200, { test: 'foo \n\n\ninvalid: bar' }); + break; + case 4: + res.writeHead(200, { test: 'foo \r\n \r\n \r\ninvalid: bar' }); + server.close(); + break; + default: + assert(false); + } + res.end('Hi mars!'); +}); +server.listen(common.PORT); + +for (var i = 0; i < 5; i++) { + var req = http.get({ port: common.PORT, path: '/' }, function(res) { + assert.strictEqual(res.headers.test, 'foo invalid: bar'); + assert.strictEqual(res.headers.invalid, undefined); + responses++; + }); +} + +process.on('exit', function() { + assert.strictEqual(responses, 5); +}); From e4d97b1dca5a01f120fb11b10f8cf04841d97d94 Mon Sep 17 00:00:00 2001 From: isaacs Date: Thu, 7 Feb 2013 10:34:45 -0800 Subject: [PATCH 02/15] blog: v0.9.9 --- doc/blog/v0.9.9.md | 78 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 doc/blog/v0.9.9.md diff --git a/doc/blog/v0.9.9.md b/doc/blog/v0.9.9.md new file mode 100644 index 0000000000..052c626d32 --- /dev/null +++ b/doc/blog/v0.9.9.md @@ -0,0 +1,78 @@ +date: Thu Feb 7 10:32:17 PST 2013 +title: Node v0.9.9 (Stable) +version: 0.9.9 +category: release +slug: node-v0-9-9-stable + +2013.02.07, Version 0.9.9 (Unstable) + +* tls: port CryptoStream to streams2 (Fedor Indutny) + +* typed arrays: only share ArrayBuffer backing store (Ben Noordhuis) + +* stream: make Writable#end() accept a callback function (Nathan Rajlich) + +* buffer: optimize 'hex' handling (Ben Noordhuis) + +* dns, cares: don't filter NOTIMP, REFUSED, SERVFAIL (Ben Noordhuis) + +* readline: treat bare \r as a line ending (isaacs) + +* readline: make \r\n emit one 'line' event (Ben Noordhuis) + +* cluster: support datagram sockets (Bert Belder) + +* stream: Correct Transform class backpressure (isaacs) + +* addon: Pass module object to NODE_MODULE init function (isaacs, Rod Vagg) + +* buffer: slow buffer copy compatibility fix (Trevor Norris) + +* Add bytesWritten to tls.CryptoStream (Andy Burke) + + +Source Code: http://nodejs.org/dist/v0.9.9/node-v0.9.9.tar.gz + +Macintosh Installer (Universal): http://nodejs.org/dist/v0.9.9/node-v0.9.9.pkg + +Windows Installer: http://nodejs.org/dist/v0.9.9/node-v0.9.9-x86.msi + +Windows x64 Installer: http://nodejs.org/dist/v0.9.9/x64/node-v0.9.9-x64.msi + +Windows x64 Files: http://nodejs.org/dist/v0.9.9/x64/ + +Linux 32-bit Binary: http://nodejs.org/dist/v0.9.9/node-v0.9.9-linux-x86.tar.gz + +Linux 64-bit Binary: http://nodejs.org/dist/v0.9.9/node-v0.9.9-linux-x64.tar.gz + +Solaris 32-bit Binary: http://nodejs.org/dist/v0.9.9/node-v0.9.9-sunos-x86.tar.gz + +Solaris 64-bit Binary: http://nodejs.org/dist/v0.9.9/node-v0.9.9-sunos-x64.tar.gz + +Other release files: http://nodejs.org/dist/v0.9.9/ + +Website: http://nodejs.org/docs/v0.9.9/ + +Documentation: http://nodejs.org/docs/v0.9.9/api/ + +Shasums: +``` +643c26c2fc0c9ddeee99d346af86a022e6b470bc node-v0.9.9-darwin-x64.tar.gz +f3ffeb08ceab15fd24a33c8d1974be952177b623 node-v0.9.9-darwin-x86.tar.gz +63d6ce5e4333a0cd203753a3153998076baa23a7 node-v0.9.9-linux-x64.tar.gz +f1008b823b6010bd3ed3fd4f422eac3af5bd61da node-v0.9.9-linux-x86.tar.gz +679b09328f1a0c3225286a891bb5b4de131777d6 node-v0.9.9-sunos-x64.tar.gz +4253f2e976a05ee6ea6ecc3b583e942b812d0b86 node-v0.9.9-sunos-x86.tar.gz +0436ee0e57d12d5fc53914f9157521427d016629 node-v0.9.9-x86.msi +8a98bc39e9c99a1a1dad6f38a47f56eeb9ad6ecd node-v0.9.9.pkg +af1deb80c79f256b319a727f8593740ff99cdbc8 node-v0.9.9.tar.gz +ab3db4d6ffab88bb1babdddd96ca8d2c6caf4625 node.exe +56f5a3c72992463435f6649b31da81fd679e91ae node.exp +e77f0097ce66317fc255b8e1642eaa675c190267 node.lib +5ff7b6d7f1001383b4bd97e1315c67e7b223477d node.pdb +5b4dcf545eace51a4cae58e9c42b73604f6eb0f9 x64/node-v0.9.9-x64.msi +43fd59cf0df5bdf21690a43a68a8f16160e28ec6 x64/node.exe +b4845d2318dd5b1030eeca02703d7f19ebf2ef15 x64/node.exp +2726441e5ff354bc51a841fa9a5a193d39831ac0 x64/node.lib +df9083c37cf13109326df30df01e9692238ac381 x64/node.pdb +``` From 2810b1ab00ffdaa1b7ed187e15fa8d7f036630db Mon Sep 17 00:00:00 2001 From: isaacs Date: Thu, 7 Feb 2013 10:35:35 -0800 Subject: [PATCH 03/15] blog: v0.9.9 is unstable, not stable --- doc/blog/v0.9.9.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/blog/v0.9.9.md b/doc/blog/v0.9.9.md index 052c626d32..d8f8bf0a09 100644 --- a/doc/blog/v0.9.9.md +++ b/doc/blog/v0.9.9.md @@ -1,8 +1,8 @@ date: Thu Feb 7 10:32:17 PST 2013 -title: Node v0.9.9 (Stable) +title: Node v0.9.9 (Unstable) version: 0.9.9 category: release -slug: node-v0-9-9-stable +slug: node-v0-9-9-unstable 2013.02.07, Version 0.9.9 (Unstable) From c4f418d035ff0e75099fcee66a6605260ca12a00 Mon Sep 17 00:00:00 2001 From: Ben Noordhuis Date: Fri, 8 Feb 2013 01:33:29 +0100 Subject: [PATCH 04/15] test: disable simple/test-dgram-send-error It's not a good citizen, it spams random IP addresses with UDP packets. Fixes #4730. --- test/{simple => disabled}/test-dgram-send-error.js | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename test/{simple => disabled}/test-dgram-send-error.js (100%) diff --git a/test/simple/test-dgram-send-error.js b/test/disabled/test-dgram-send-error.js similarity index 100% rename from test/simple/test-dgram-send-error.js rename to test/disabled/test-dgram-send-error.js From 6dcadb9fc8618d45e696169135141dde4a9780b0 Mon Sep 17 00:00:00 2001 From: isaacs Date: Tue, 12 Feb 2013 12:03:52 -0800 Subject: [PATCH 05/15] blog: Peer Dependencies article Thanks, @domenic --- doc/blog/npm/peer-dependencies.md | 133 ++++++++++++++++++++++++++++++ 1 file changed, 133 insertions(+) create mode 100644 doc/blog/npm/peer-dependencies.md diff --git a/doc/blog/npm/peer-dependencies.md b/doc/blog/npm/peer-dependencies.md new file mode 100644 index 0000000000..97cb990ead --- /dev/null +++ b/doc/blog/npm/peer-dependencies.md @@ -0,0 +1,133 @@ +category: npm +title: Peer Dependencies +date: 2013-02-08T00:00:00Z +author: Domenic Denicola + +Reposted from [Domenic's +blog](http://domenic.me/2013/02/08/peer-dependencies/) with +permission. Thanks! + +npm is awesome as a package manager. In particular, it handles sub-dependencies very well: if my package depends on +`request` version 2 and `some-other-library`, but `some-other-library` depends on `request` version 1, the resulting +dependency graph looks like: + +```text +├── request@2.12.0 +└─┬ some-other-library@1.2.3 + └── request@1.9.9 +``` + +This is, generally, great: now `some-other-library` has its own copy of `request` v1 that it can use, while not +interfering with my package's v2 copy. Everyone's code works! + +## The Problem: Plugins + +There's one use case where this falls down, however: *plugins*. A plugin package is meant to be used with another "host" +package, even though it does not always directly *use* the host package. There are many examples of this pattern in the +Node.js package ecosystem already: + +- Grunt [plugins](http://gruntjs.com/#plugins-all) +- Chai [plugins](http://chaijs.com/plugins) +- Levelup [plugins](https://npmjs.org/package/level-hooks) +- Express [middleware](http://expressjs.com/api.html#middleware) +- Winston [transports](https://github.com/flatiron/winston/blob/master/docs/transports.md) + +Even if you're not familiar with any of those use cases, surely you recall "jQuery plugins" from back when you were a +client-side developer: little ` + diff --git a/deps/npm/html/doc/start.html b/deps/npm/html/doc/start.html index 3e6aa1ca64..4a42ee1e1a 100644 --- a/deps/npm/html/doc/start.html +++ b/deps/npm/html/doc/start.html @@ -20,7 +20,7 @@ - +