This change disables SSLv2/SSLv3 use by default, and introduces a
command line flag to opt into using SSLv2/SSLv3.
SSLv2 and SSLv3 are considered unsafe, and should only be used in
situations where compatibility with other components is required and
they cannot be upgrade to support newer forms of TLS.
Because of constant-timeness change made in openssl-1.0.1j the error is
no longer returned from EVP_DecryptFinal_ex. Now it just return 0, and
thus the error message does not contain proper error code. Adapt to this
change, there is not much that we could do about it.
Expands the paragraph in the transform stream
implementation docs about the callback that is passed
to the _transform method to include details about how
two arguments may be passed, error and data. A code
example is also included.
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Currently, a TypeError is incorrectly thrown if the second argument is
an object. This commit allows the args argument to be properly omitted.
Fixes: https://github.com/joyent/node/issues/6068
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
* npm: Update to 1.4.28
* v8: fix a crash introduced by previous release (Fedor Indutny)
* configure: add --openssl-no-asm flag (Fedor Indutny)
* crypto: use domains for any callback-taking method (Chris Dickinson)
* http: do not send `0rnrn` in TE HEAD responses (Fedor Indutny)
* querystring: fix unescape override (Tristan Berger)
* url: Add support for RFC 3490 separators (Mathias Bynens)
When replying to a HEAD request, do not attempt to send the trailers and
EOF sequence (`0\r\n\r\n`). The HEAD request MUST not have body.
Quote from RFC:
The presence of a message body in a response depends on both the
request method to which it is responding and the response status code
(Section 3.1.2). Responses to the HEAD request method (Section 4.3.2
of [RFC7231]) never include a message body because the associated
response header fields (e.g., Transfer-Encoding, Content-Length,
etc.), if present, indicate only what their values would have been if
the request method had been GET (Section 4.3.1 of [RFC7231]).
fix#8361
Reviewed-By: Timothy J Fontaine <tjfontaine@gmail.com>
This adds domains coverage for pdbkdf2, pseudoRandomBytes, and randomBytes.
All others should be covered by event emitters.
Fixes#5801.
Reviewed-By: Timothy J Fontaine <tjfontaine@gmail.com>
The behavior of the `node_modules` lookup algorithm was
changed in #1177, but the documentation was not updated completely
to describe the new behavior.
The pseudocode of the lookup algorithm did not metion that
`index.json` is tried to be loaded if you require a folder.
Reviewed-By: Fedor Indutny <fedor@indutny.com>
PR #8034 came with a test to make sure that timers expiry is based on
monotonic time and not on wall-clock time. However, a bug in the
implementation broke timers with non-integer delays. A fix for this
issue was provided with PR #8073, but it didn't come with a test.
Because #8073 fixed a subtle issue that could reappear in the future,
and because the impact of such an issue would be significant, I suggest
adding this test.
The test would timeout after 1 minute if the issue was reproduced.
Otherwise it will run very quickly.
Reviewed-By: Fedor Indutny <fedor@indutny.com>
There is no need to split the host by hand in `url.js` – Punycode.js
takes care of it anyway. This not only simplifies the code, but also
adds support for RFC 3490 separators (i.e. not just U+002E, but U+3002,
U+FF0E, and U+FF61 as well).
Closes#6055.
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Documentation states that `querystring.unescape` may be overridden to
replace unescaper during parsing. However, the function was only
being used as a fallback for when the native decoder throws (on a
malformed URL). This patch moves the call to the native function and
the try/catch around it into querystring.unescape then has the parser
always invoke it, so that an override will always be used.
Fixes#4055
Reviewed-By: Fedor Indutny <fedor@indutny.com>
fd80a31e06 has introduced a segfault
during redundant boundary check elimination (#8208).
The problem consists of two parts:
1. Abscense of instruction iterator in
`EliminateRedundantBoundsChecks`. It was present in recent v8, but
wasn't considered important at the time of backport. However, since
the function is changing instructions order in block, it is
important to not rely at `i->next()` at the end of the loop.
2. Too strict ASSERT in `MoveIndexIfNecessary`. It is essentially a
backport of a45c96ab from v8's upstream. See
https://github.com/v8/v8/commit/a45c96ab for details.
fix#8208
Send messages until both the parent and the child process have received
at least one message. If at least one of them doesn't receive any
message, the test runner will make the test timeout.
Fixes#8046.
When backporting f8193ab into v0.10, a regression was introduced. Timers
with non-integer timeout could trigger a infinite recursion with 100%
cpu usage. This commit backports 93b0624 which fixes the regression.
After backporting f8193ab, instead of using Date.now(), timers would use
Timer.now() to determine if they had expired. However, Timer.now() is
based on loop->time, which is not updated when a timer's remaining time
is > 0 and < 1. Timers would thus never timeout if their remaining time
was at some point > 0 and < 1.
With this commit, Timer.now() updates loop->time itself, and timers
always timeout eventually.
Fixes#8065 and #8068.
Callbacks in node are usually asynchronous, and should never be
sometimes synchronous, and sometimes asynchronous.
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
A streams1 stream will have its falsy values such as 0, false, or ""
eaten by the upgrade to streams2, even when objectMode is enabled.
Include test for said cases.
Reviewed-by: isaacs <i@izs.me>
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
Timothy J Fontaine
Fedor Indutny
Swaagie
Matthew Fitzsimmons
Calvin Metcalf
cjihrig
Chris Dickinson
Maciej Małecki
Mathias Schreck
Julien Gilli
Mathias Bynens
Tristan Berger
Fedor Indutny
Jackson Tian
Kevin Simper
Sam Roberts
James Halliday
Jakob Gillich