Ref: https://github.com/nodejs/node-convergence-archive/issues/13
This adds a new check for header and trailer fields names and method
names to ensure that they conform to the HTTP token rule. If they do
not, a `TypeError` is thrown.
Previously this had an additional `strictMode` option that has been
removed in favor of making the strict check the default (and only)
behavior.
Doc and test case are included.
On the client-side
```javascript
var http = require('http');
var url = require('url');
var p = url.parse('http://localhost:8888');
p.headers = {'testing 123': 123};
http.client(p, function(res) { }); // throws
```
On the server-side
```javascript
var http = require('http');
var server = http.createServer(function(req,res) {
res.setHeader('testing 123', 123); // throws
res.end('...');
});
```
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Trevor Norris <trevnorris@nodejs.org>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
PR-URL: https://github.com/nodejs/node/pull/2526
Instead of slicing the first element off of the matches, shift and then
return. This improves performance of the following path functions:
- basename: 18-20%
- extname: 60-70%
- dirname: 18-20%
- parse: 20-25%
PR-URL: https://github.com/nodejs/node/pull/3034
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
It is required for using the "SIGABRT" constant.
It doesn't cause compilation errors in Node because most files already
have "signal.h" included, but it causes errors for third party embedder.
PR-URL: https://github.com/nodejs/node/pull/3058
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
The `src/node.js` file is actually loaded and executed by
`node::LoadEnvironment` function.
The variable which has the contents is, `native_node`.
PR-URL: https://github.com/nodejs/node/pull/3039
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
issue #2987 makes the point that crypto.pbkdf2 should not fail silently
and accept invalid but numeric values like NaN and Infinity. We already
check if the keylen is lower than 0, so extending that to NaN and
Infinity should make sense.
Fixes: https://github.com/nodejs/node/issues/2987
PR-URL: https://github.com/nodejs/node/pull/3029
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
`HandleWrap::OnClose` destroys the underlying C++ object and null's the
internal field pointer to it. Therefore there should be no references to
the wrapping JavaScript object.
`null` the process' `_channel` field right after closing it, to ensure
no crashes will happen.
Fix: https://github.com/nodejs/node/issues/2847
PR-URL: https://github.com/nodejs/node/pull/3041
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
The .bin/ directory in deps/npm/node_modules seens to have been an
accidental check-in in commit e79ccee ("npm: upgrade to v2.1.18").
It causes trouble for distro packagers so delete it and blacklist it.
Fixes: https://github.com/nodejs/node/issues/2839
PR-URL: https://github.com/nodejs/node/pull/3004
Reviewed-By: Kat Marchán <kzm@sykosomatic.org>
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
The documentation for assert.doesNotThrow now reflects all the inputs
the function accepts, as well as the errors thrown for each combination
of parameter types.
PR-URL: https://github.com/nodejs/node/pull/2807
Reviewed-By: Rich Trott <rtrott@gmail.com>
Changed the ordering so it is in line with the async methods.
PR-URL: https://github.com/nodejs/node/pull/2940
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>
Notable changes
* buffer: Fixed a bug introduced in v4.1.0 where allocating a new
zero-length buffer can result in the next allocation of a TypedArray
in JavaScript not being zero-filled. In certain circumstances this
could result in data leakage via reuse of memory space in
TypedArrays, breaking the normally safe assumption that TypedArrays
should be always zero-filled. (Trevor Norris) #2931.
* http: Guard against response-splitting of HTTP trailing headers
added via response.addTrailers() by removing new-line ([\r\n])
characters from values. Note that standard header values are already
stripped of new-line characters. The expected security impact is low
because trailing headers are rarely used. (Ben Noordhuis) #2945.
* npm: Upgrade to npm 2.14.4 from 2.14.3, see release notes for full
details (Kat Marchán) #2958
- Upgrades graceful-fs on multiple dependencies to no longer rely on
monkey-patching fs
- Fix npm link for pre-release / RC builds of Node
* v8: Update post-mortem metadata to allow post-mortem debugging tools
to find and inspect:
- JavaScript objects that use dictionary properties
(Julien Gilli) #2959
- ScopeInfo and thus closures (Julien Gilli) #2974
PR-URL: https://github.com/nodejs/node/pull/2995
The `events` module already exports `EventEmitter` constructor function
So, we don't have to use `events.EventEmitter` to access it.
Refer: https://github.com/nodejs/node/pull/2896
PR-URL: https://github.com/nodejs/node/pull/2921
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
The `events` module already exports `EventEmitter` constructor function
So, we don't have to use `events.EventEmitter` to access it.
Refer: https://github.com/nodejs/node/pull/2896
PR-URL: https://github.com/nodejs/node/pull/2921
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Logic for calling the passed in socket method and/or callback
was duplicated. This commit refactors the relevant code to
remove the redundancy.
PR-URL: https://github.com/nodejs/node/pull/2769
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Brendan Ashworth <brendan.ashworth@me.com>
The actual problem was with the line parsing logic for string literals.
When we use backslash in the string literals, it used to remember the
`\` as the previous character even after we parsed the character next
to it. This leads to REPL thinking that the end of string literals is
not reached.
This patch replaces the previous character with `null`, so that it will
properly skip the character next to it.
Previous Discussion: https://github.com/nodejs/node/pull/2952
Fixes: https://github.com/nodejs/node/issues/2749
PR-URL: https://github.com/nodejs/node/pull/2968
Reviewed-By: Roman Reiss <me@silverwind.io>
Backport 357e6b99ee3927cc075dd8d27c99b89d858f9dd5 from V8's upstream.
Original commit message:
Add ScopeInfo constants to post-mortem metadata
mdb_v8, a post-mortem debugging tool for Node.js, allows users to
inspect ScopeInfo structures in order to get more information about
closures.
Currently, it hardcodes the metadata it uses to find this information.
This change allows it to get this metadata from the node binary itself,
and thus to adapt to future changes made to the layout of the ScopeInfo
data structure.
BUG=
R=bmeurer@chromium.org
PR: #2974
PR-URL: https://github.com/nodejs/node/pull/2974
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Ben Noordhuis <ben@strongloop.com>
v8::HandleScope does not seem to be required for addon functions.
PR-URL: https://github.com/nodejs/node/pull/2983
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Detect mipsel before mips because mipsel has __mips__ flag as well.
PR-URL: https://github.com/nodejs/node/pull/2971
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
This patch includes tests for sync versions of mkdir and rmdir.
Also, it moves the test to `parallel`.
PR-URL: https://github.com/nodejs/node/pull/2588
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Johan Bergström <bugs@bergstroem.nu>
Original commit message:
Update BitField3 type in gen-postmortem-metadata.py
Since https://codereview.chromium.org/272163002, BitField3 is a raw
uint32 field, and not a SMI anymore.
Update tools/gen-postmortem-metadata.py so that post-mortem tools can
work with versions of V8 that shipped after that change.
This change was merged in github.com/joyent/node right before node
v0.12.0 was released.
R=danno@chromium.org
TEST=mdb_v8, a post-mortem debugging tool running on SmartOS, has been
using this change since Node.js v0.12.0 was released
BUG=
Review URL: https://codereview.chromium.org/1296743003
Cr-Commit-Position: refs/heads/master@{#30839}
PR: #2959
PR-URL: https://github.com/nodejs/node/pull/2959
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Rod Vagg <r@va.gg>
This patch
- makes the test use tmp directory instead of the fixtures directory,
- simplifies the code
- moves the test to `parallel`.
PR-URL: https://github.com/nodejs/node/pull/2587
Reviewed-By: Rich Trott <rtrott@gmail.com>
`freeParser` deallocates `Parser` instances early if they do not fit
into the free list. This does not play well with recent socket
consumption change, because it will try to deallocate the parser while
executing on its stack.
Regression was introduced in: 1bc4468
Fix: https://github.com/nodejs/node/issues/2928
PR-URL: https://github.com/nodejs/node/pull/2956
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
This fixes a few typographical errors (comma splices and the like) and
clarifies the description of assert.ifError(). It also standardizes the
document on "inequality" rather than having both "inequality" and "non-
equality".
PR-URL: https://github.com/nodejs/node/pull/2941
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Commit 3c293ba ("http: protect against response splitting attacks")
filters out newline characters from HTTP headers but forgot to apply
the same logic to trailing HTTP headers, i.e., headers that come after
the response body. This commit rectifies that.
The expected security impact is low because approximately no one uses
trailing headers. Some HTTP clients can't even parse them.
PR-URL: https://github.com/nodejs/node/pull/2945
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Rod Vagg <r@va.gg>
The test verified the output of http.OutgoingMessage#writeHead() but
not http.OutgoingMessage#setHeader(). Also check the response body.
PR-URL: https://github.com/nodejs/node/pull/2945
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Rod Vagg <r@va.gg>
Adding a Windows test to verify that a node process spawned via
cmd with named pipes can access its stdio streams.
Ref: https://github.com/nodejs/node-v0.x-archive/issues/7345
PR-URL: https://github.com/nodejs/node/pull/2770
Reviewed-By: cjihrig - Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: thefourtheye - Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: evanlucas - Evan Lucas <evanlucas@me.com>
Instantiating a Buffer of length zero would set the kNoZeroFill flag to
true but never actually call ArrayBuffer::Allocator(). Which means the
flag was never set back to false. The result was that the next
allocation would unconditionally not be zero filled.
Add test to ensure Uint8Array's are zero-filled after creating a Buffer
of length zero. This test may falsely succeed, but will not falsely fail.
Fix: https://github.com/nodejs/node/issues/2930
PR-URL: https://github.com/nodejs/node/pull/2931
Reviewed-By: Rod Vagg <rod@vagg.org>
Currently there are three separate tick processor scripts for
mac, windows, and linux. These have been replaced with a single
node.js script to improve maintainability and remove the need
to preserve parallel logic in these separate places.
PR-URL: https://github.com/nodejs/node/pull/2868
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Add corrections about when exit event fires and how .kill() works on
Windows.
PR-URL: https://github.com/nodejs/node/pull/2918
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Fix regression introduced in 0af4c9ea74
that ignores the --abort-on-uncaught-exception flag. Prior to that
commit, the flag was passed through to v8. After that commit, the
process just calls exit(1).
PR-URL: https://github.com/nodejs/node/pull/2776
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
Windows 8+ compiled in Release mode exits with code 0xC0000409 when
abort() is called. This prevents us from being able to reliably verify
an abort exit code (3) on windows.
PR-URL: https://github.com/nodejs/node/pull/2776
Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
Fix a build error that occurs when icutrim is run to cut down
the ICU locale set on Big-Endian platforms when building with
--with-intl=small-icu (which is done by the "make binary" target).
This fixes the binary build on POWER platforms.
Fixes: https://github.com/nodejs/node/issues/2601
PR-URL: https://github.com/nodejs/node/pull/2602
Reviewed-By: Steven Loomis <srloomis@us.ibm.com>
Port f3f4e28216
to master, updating to guard changes for AIX as requested
PR-URL: https://github.com/nodejs/node/pull/2891
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
On AIX you can not remove a directory that you are currently inside of
as it results in an EBUSY error. "EBUSY: resource busy or locked".
Updated the tests accordingly so that they are skipped on AIX.
PR-URL: https://github.com/nodejs/node/pull/2909
Reviewed-By: Ben Noordhuis <ben@strongloop.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Original commit message:
[es6] Bound function name
Instead of updating the SharedFuntionInfo set the name property on
the function directly.
BUG=v8:4278
LOG=N
R=verwaest@chromium.org, littledan@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
Review URL: https://codereview.chromium.org/1227523003
Cr-Commit-Position: refs/heads/master@{#29558}
Fixes: https://github.com/nodejs/node/issues/2754
PR-URL: https://github.com/nodejs/node/pull/2916
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
As `raw` and `raws` encodings are deprecated for such a long time, and
they both are undocumented, this patch removes the support for those
encodings completely.
Previous discussion: https://github.com/nodejs/node/pull/2829
PR-URL: https://github.com/nodejs/node/pull/2859
Reviewed-By: Brian White <mscdex@mscdex.net>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
This patch
- makes chdir test to use the tmp directory
- moves the test to parallel
- renames the file to test-process-chdir as chdir is in process module
PR-URL: https://github.com/nodejs/node/pull/2589
Reviewed-By: Brendan Ashworth <brendan.ashworth@me.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
This change:
* notes that the exit event is not guaranteed to fire
* provides an example situation where the exit event may not fire
* makes a minor copyediting change
* enforces 80 character wrap in one place where it was not honored
Fixes: https://github.com/nodejs/node/issues/2853
PR-URL: https://github.com/nodejs/node/pull/2861
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
James M Snell
Evan Lucas
Cheng Zhao
Sakthipriyan Vairamani
Johann
Fedor Indutny
Ben Noordhuis
Julien Gilli
Michał Gołębiowski
Fabio Oliveira
P.S.V.R
Laurent Fortin
reggi
Rod Vagg
Salman Aljammaz
Malcolm Ahoy
Christopher J. Brody
Jérémy Lal
Kat Marchán
Rich Trott
Alexis Campailla
Matt Harrison
Trevor Norris
Matt Loring
Stewart Addison
Michael Dawson
Imran Iqbal
Jeremiah Senkpiel
Michaël Zasso