lukechilds/node - node - Gitea: Git with a cup of tea

13128 Commits

131 Branches

446 Tags

325 MiB

Tree: 7bef1b7907

Commit Graph

Author	SHA1	Message	Date
James M Snell	d387591bbb	src: add --security-revert command line flag The `--security-revert={cvenum}` command line flag is a special purpose flag to be used only in stable or LTS branches when a breaking change is required to address a security vulnerability. Whenever a vulnerability requires a breaking change, and a CVE has been assigned, the flag can be used to force Node to revert to the insecure behavior that was implemented before the fix was applied. Note that this flag is intended to be used only as a last resort in the case a security update breaks existing code. When used, a security warning will be printed to stderr when Node launches. The `--security-revert={cvenum}` flag takes a single CVE number as an argument. Multiple instances of the `--security-revert={cvenum}` flag can be used on the command line to revert multiple changes. Whenever a new `--security-revert={cvenum}` is enabled, it should be documented in the release notes and in the API docs. Master and the first release of a new major (e.g. v6.0) should not have any reverts available. Every time a new `--security-revert={cvenum}` is added, there should be a semver-minor bump in the stable and LTS branch. PR-URL: https://github.com/nodejs/node-private/pull/26 Reviewed-By: Rod Vagg <r@va.gg> Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>	9 years ago

Author

SHA1

Message

Date

James M Snell

d387591bbb

src: add --security-revert command line flag

The `--security-revert={cvenum}` command line flag is a special purpose
flag to be used only in stable or LTS branches when a breaking change
is required to address a security vulnerability. Whenever a vulnerability
requires a breaking change, and a CVE has been assigned, the flag can
be used to force Node to revert to the insecure behavior that was
implemented before the fix was applied.

Note that this flag is intended to be used only as a last resort in the
case a security update breaks existing code. When used, a security
warning will be printed to stderr when Node launches.

The `--security-revert={cvenum}` flag takes a single CVE number as an
argument. Multiple instances of the `--security-revert={cvenum}` flag
can be used on the command line to revert multiple changes.

Whenever a new `--security-revert={cvenum}` is enabled, it should be
documented in the release notes and in the API docs.

Master and the first release of a new major (e.g. v6.0) should not have
any reverts available.

Every time a new `--security-revert={cvenum}` is added, there should be
a semver-minor bump in the stable and LTS branch.

PR-URL: https://github.com/nodejs/node-private/pull/26
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

9 years ago

1 Commits (7bef1b790727430cb82bf8be80cfe058480de100)