QueryString.stringify() allowed a fourth argument that was used as a
conditional in the return value, but was undocumented, not used by core
and always was always false/undefiend. So the argument and conditional
have been removed.
Signed-off-by: Trevor Norris <trev.norris@gmail.com>
After landing 6ed861d it is no longer possible to reliably monkey-patch
the EventEmitter constructor. However there's valid use cases for that,
and makes for easier debugging. Therefore, move the guts of the
constructor to a separate function which is monkey-patchable.
Closes#6693
The UNIX domain is also known as the LOCAL domain (AF_LOCAL), and
node/libuv implements it on Windows using named pipes. The API
documentation did not describe the naming rules for named pipes, and
also repeatedly described `listen(path)` as being UNIX, which it is not
on Windows.
Closes#6743
Removing a hack intended to shortcut the resolution of 'localhost'
but which doesn't work for ipv6.
This was introduced in 2876141c42.
However it seems that the problems that this was trying to
circumvent has gone away ages ago, when dns resolution on
Windows started relying on Win32 GetAddrInfoW, which was
probably with be2320d408.
Fixes test-net-connect-options-ipv6.js on Windows.
The %p is replaced with the current PID. This used to work in node.js
v0.9.7 but it seems to have been lost somewhere along the way.
This commit makes the fix from 6b713b52 ("cluster: make --prof work for
workers") work again. Without it, all log data ends up in a single
file and is unusable because the addresses are all wrong.
Eliminate a race condition between uv_async_send and the closing of the
corresponding handle.
Also made errors in Watchdog constructor call abort()
Fixes#6088
The 1.3.19 release had a critical bug: any packages published with it
could not be installed, because the shasum would be incorrect.
Thankfully, 1.3.19 was published using 1.3.19, so could not be installed
by any users! However, if it goes out as part of a Node.js release,
then obviously that would be a problem.
This is a comment change, where it originally says disabling TLS
Compression protects against BEAST attack. But in fact, it is the
CRIME attack(Compression Ratio Info-leak Made Easy) that makes use
of TLS Compression and not BEAST.
BEAST(Browser Exploit Against SSL/TLS) is an entirely another variant
making use of the chosen boundary attack against CBC mode in
encryption.
Just making sure, that the exact reason for disabling TLS compression
must be made clear and not be misleading with some other attack.
Quoting CVE-2013-6639:
The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8
before 3.22.24.7, as used in Google Chrome before 31.0.1650.63,
allows remote attackers to cause a denial of service (out-of-bounds
write) or possibly have unspecified other impact via JavaScript code
that sets the value of an array element with a crafted index.
Quoting CVE-2013-6640:
The DehoistArrayIndex function in hydrogen-dehoist.cc in Google V8
before 3.22.24.7, as used in Google Chrome before 31.0.1650.63,
allows remote attackers to cause a denial of service (out-of-bounds
read) via JavaScript code that sets a variable to the value of an
array element with a crafted index.
Like 6b92a7, this is unlikely to affect node.js because it only runs
local, trusted code. However, if there exists some module somewhere
that populates an array index with remotely provided data this could
very well be used to crash a remote server running node. Defense in
depth and all.
This is a backport of upstream commit r17801. Original commit log:
Limit size of dehoistable array indices
LOG=Y
BUG=chromium:319835,chromium:319860
R=dslomov@chromium.org
Review URL: https://codereview.chromium.org/74113002
pflannery
Dav Glass
Yorkie
Lev Gimelfarb
Fedor Indutny
Benjamin Waters
isaacs
Vladimir Kurchatkin
Trevor Norris
Paul Loyd
Bert Belder
T.C. Hollingsworth
Alexis Campailla
Cam Swords
Sam Roberts
Timothy J Fontaine
Yorkie
Ben Noordhuis
Ahamed Nafeez
jkummerow@chromium.org
Wyatt Preul
Lalit Kapoor
Nicolas Kaiser
Mathias Bynens
Gabriel Farrell