child_process.exec*() and child_process.spawn*() (if options.shell is
true) allow trivial arbitrary command execution if code passes
unsanitised user input to it. Add warnings in the docs to make that
clear.
PR-URL: https://github.com/nodejs/node/pull/10466
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
* use const instead of var
* use common.mustCall to control functions execution
* use assert.strictEqual instead of assert.equal
* use arrow functions
PR-URL: https://github.com/nodejs/node/pull/10479
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Italo A. Casas <me@italoacasas.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Collaborators have elevated privileges. The CTC now requires
Collaborator accounts to have two-factor authentication. This changes
wording in the onboarding documentation to make it clear that two-factor
authentication is required and not merely recommended.
PR-URL: https://github.com/nodejs/node/pull/10529
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
* use common.mustCall to control the functions execution automatically
* use let and const instead of var
* use assert.strictEqual instead of assert.equal
* use arrow functions
* remove console.error and unnecessary variables
PR-URL: https://github.com/nodejs/node/pull/10397
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
* replace `process.on('exit', ...)` checks with `common.mustCall()`
* assert.equal() -> assert.strictEqual()
* provide duration of 1ms to timer without a duration
* remove unused function argument
PR-URL: https://github.com/nodejs/node/pull/10483
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Italo A. Casas <me@italoacasas.com>
Bump configure download path for ICU from 58.1 to 58.2
* This commit just changes the download URL.
PR-URL: https://github.com/nodejs/node/pull/10206
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Bump ICU from 58.1 to 58.2
No feature changes. Bug fixes.
* This commit contains the actual ICU source code and data.
* CLDR 30.0.3 ( was 30.0.2)
* Timezone 2016j ( was 2016g )
ICU Details:
http://site.icu-project.org/download/58#TOC-Updates-in-ICU-58.2
PR-URL: https://github.com/nodejs/node/pull/10206
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Use of abort() was added in 34febfbf4, and changed to ABORT()
in 21826ef21a, but conditional+ABORT() is better expressesed
using a CHECK_xxx() macro.
See: https://github.com/nodejs/node/pull/9409#discussion_r93575328
PR-URL: https://github.com/nodejs/node/pull/10413
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/10478
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Italo A. Casas <me@italoacasas.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
This commit uses instanceof instead of Array.isArray() for faster
type checking and avoids calling Object.keys() when the headers are
stored as a 2D array instead of a plain object.
PR-URL: https://github.com/nodejs/node/pull/6533
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Since at least V8 5.4, using function.bind() is now fast enough to
use to avoid recompiling/reoptimizing the same anonymous functions.
These changes especially impact http servers.
PR-URL: https://github.com/nodejs/node/pull/6533
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
The new table-based lookups perform significantly better for the
common cases (checking latin1 characters).
PR-URL: https://github.com/nodejs/node/pull/6533
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
The GitHub interface for new pull requests has started prepending
commit messages for single-commit pull requests. It had previously
been appending them. Modify the GitHub template to accommodate the new
behavior.
PR-URL: https://github.com/nodejs/node/pull/10484
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Prince John Wesley <princejohnwesley@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
To ease the use of the AIX binaries, add
/opt/freeware/lib/pthread{/ppc64} into the search path encoded into the
library, so that any version the user has installed from the common
download locations will work out of the box without having to explicitly
set LIBPATH in their environment.
PR-URL: https://github.com/nodejs/node/pull/10128
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
* Simplify regular expressions (see below)
* Remove unneeded `parseYAML()` wrapper
* Remove unused callback argument
Regular expression simplifications include:
* Changing trailing `*?$/` to `*$/` because non-greedy matching to the
end of a line will not change behavior
* Change regexp beginnings like `/^(?:property:?\s*)?[^.\[]+` to the
equivalent `/[^.\]]+`
* For regular expressions changed per the above, remove
case-insensitivity if it no longer affects the regexp
PR-URL: https://github.com/nodejs/node/pull/10442
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Italo A. Casas <me@italoacasas.com>
Remove console.log statement. Replace error check with
assert.ifError().
PR-URL: https://github.com/nodejs/node/pull/10331
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Italo A. Casas <me@italoacasas.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
This commit takes advantage of the performance improvements V8 has
made to function.bind() in V8 5.4 and uses it to avoid constant
recompilation/reoptimization of the wrapper closure used in once().
This change results in ~27% performance increase for once().
PR-URL: https://github.com/nodejs/node/pull/10445
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Teddy Katz <teddy.katz@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
- Change var to const
- Remove dependency crypto
PR-URL: https://github.com/nodejs/node/pull/10033
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
* remove the manual control for functions execution
* use common.mustCall to control the functions execution automatically
* use let and const instead of var
* use assert.strictEqual instead assert.equal
PR-URL: https://github.com/nodejs/node/pull/10200
Reviewed-By: Italo A. Casas <me@italoacasas.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
* use const and let instead of var
* use common.mustCall to control functions executions
* use assert.strictEqual instead of assert.equal
* use assert.ifError to handle errors
* use arrow functions
* remove unnecessary variables
PR-URL: https://github.com/nodejs/node/pull/10440
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
assertSize() is adjusted to be inlineable according to V8's default
function size limits when determining inlineability. This results in
up to 11% performance gains when allocating any kind of Buffer.
Avoid avoids use of in, resulting in ~50% improvement when creating
a Buffer from an array-like object.
PR-URL: https://github.com/nodejs/node/pull/10443
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
This is to resolve an unused result warning in node_url.cc.
Resolve macro redefinition warning on Windows
PR-URL: https://github.com/nodejs/node/pull/10141
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Resolve build warnings on Windows with the following pattern:
warning C4244: '=': conversion from 'int64_t' to 'int32_t',
possible loss of data
PR-URL: https://github.com/nodejs/node/pull/10143
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Swap var for let/const throughout the common.js module.
Change a snake case variable to camel case starting on line 168.
PR-URL: https://github.com/nodejs/node/pull/10177
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/10245
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
A user can change the default curve for ECDH key agreement by
using tls.DEFAULT_ECDH_CURVE.
PR-URL: https://github.com/nodejs/node/pull/10264
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Italo A. Casas <me@italoacasas.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
When decodeStrings is false and given data is string, _write() function
receives the string data not `Buffer`.
PR-URL: https://github.com/nodejs/node/pull/10411
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Current comment described what to do with it when the ABI changes, but
implied that Node.js would load modules with newer ABI numbers, which it
will not.
PR-URL: https://github.com/nodejs/node/pull/10414
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Italo A. Casas <me@italoacasas.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Object.setPrototypeOf() -> Object.create()
PR-URL: https://github.com/nodejs/node/pull/10451
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
* use const and let instead of var
* use common.mustCall to control functions executions
* use assert.strictEqual instead of assert.equal
* use assert.ifError to handle errors
* use arrow functions
* remove console.log and process.stdout.write
PR-URL: https://github.com/nodejs/node/pull/10452
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
* use const instead of var
* use common.mustCall to control the functions execution automatically
* use assert.strictEqual instead of assert.equal
* use assert.notStrictEqual instead of assert.notEqual
* use arrow functions
PR-URL: https://github.com/nodejs/node/pull/10367
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
* use const instead of var
* use assert.strictEqual instead assert.equal
PR-URL https://github.com/nodejs/node/pull/10428
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
* use const instead of var
* use assert.strictEqual instead of assert.equal
PR-URL: https://github.com/nodejs/node/pull/10429
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
This test expects the string 'Debugger listening on port' on stderr and
since the message has been changed to 'Debugger listening on host:port'
this was failing always.
Apart from that, this test expects the main script's name to be
`src/node.js`, but that has been renamed to `lib/internal/node.js` and
then to `lib/internal/bootstrap_node.js`. So, the script name has been
updated.
Apart from that, using `const` instead of `var` wherever possible.
Refer: https://github.com/nodejs/node/issues/10361
PR-URL: https://github.com/nodejs/node/pull/10371
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
The current autoinserted link leads to 404 page.
PR-URL: https://github.com/nodejs/node/pull/10244
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Replaced with an object shorthand and an arrow function.
PR-URL: https://github.com/nodejs/node/pull/10244
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Matthew Garrett
Adrian Estrada
Rich Trott
Joyee Cheung
Steven R. Loomis
Sam Roberts
Fabrice Tatieze
Brian White
Stewart X Addison
Rob Adelmann
Chris Story
William Kapke
Nate
Matt Crummey
Sarah Meyer
Christopher J. Brody
Paul Graham
jBarz
Jesús Leganés-Combarro 'piranna
Fumiya KARASAWA
Vse Mozhet Byt
Sakthipriyan Vairamani (thefourtheye)