This is a flag to make it easier for users to upgrade through the
breaking crypto change, and easier for us to switch it back if it's a
problem.
Explicitly set default encoding to 'buffer' in other tests, in case it
ever changes back.
crypto: Hash and Hmac default to buffers
crypto: Move Cipher encoding logic to JS
crypto: Move Cipheriv encoding logic to JS
crypto: Move Decipher encoding logic to JS
crypto: Move Decipheriv into JS, default to buffers
crypto: Move Sign class to JS
crypto: Better encoding handling in Hash.update
crypto: Move Verify class to JS
crypto: Move DiffieHellman to JS, default to buffers
crypto: Move DiffieHellmanGroup to JS, default to buffers
Also, create a test for this feature
Before there was this weird module-scoped "context" variable which seemingly
shared the "context" of subsequent REPL instances, unless ".clear" was invoked
inside the REPL. To be proper, we need to ensure that each REPL gets its own
"context" object. I literally don't know why this "sharing" behavior was in place
before, but it was just plain wrong.
Consolidates all the formatting options into an "options" object argument.
This is so that we don't have to be constantly remembering the order of
the arguments and so that we can add more formatting options easily.
Closes#4085.
Listen for the 'clientError' event that is emitted when a renegotation attack
is detected and close the connection.
Fixes test/pummel/test-https-ci-reneg-attack.js
Make the 'listening' event handler in the master process see the actual port
that the worker bound to when the worker specified port 0, i.e. a random port.
Encoding failures can be somewhat confusing, especially when they are due to
control flow frameworks auto-filling parameters from the previous step output
values to functions (such as toString and write) that developers don't expect
to take an encoding parameter. By outputting the value as part of the message,
should make it easier to track down these sort of bugs.
This reverts commit 790d651f0d.
This makes Duplex streams unworkable, and would only ever be a special
case for HTTP responses, which is not ideal.
Intead, we're going to just bless the 'finish' event for all Writable
streams in 0.10
Just as the 'WWW-Authenticate' HTTP header the 'Proxy-Authenticate' header might
be received several times as well. Currently only one value is preserved. This
change allows to receive multiple values concatenated by space and comma.
Just as the 'WWW-Authenticate' HTTP header the 'Proxy-Authenticate' header might
be received several times as well. Currently only one value is preserved. This
change allows to receive multiple values concatenated by space and comma.
A child process created with .fork() needed to call `process.exit()` explicitly
because the communication channel with the parent kept the event loop alive.
Fix that by only ref'ing the channel when there are 'message' event listeners.
Fixes#3799.
This addresses #4034. There are two problems happening:
1. The domain is not exited automatically when calling dispose() on it.
Then, since the domain is disposed, attempting to exit it again will do
nothing.
2. The active domain is stored on process.domain. Since thrown errors
call `process.emit('uncaughtException', er)`, and the process is an
event emitter with a `.domain` member, it re-enters the domain a second
time before calling the error handler, pushing it onto the stack again.
Thus, if the handler calls `domain.dispose()`, then the domain is now on
the stack twice, and cannot be exited properly. Since the domain is
disposed, any subsequent IO will be no-op'ed, since we've declared that
this context is done and best forgotten.
The solution here is twofold:
1. In EventEmitter.emit, do not enter the domain if `this===process`.
2. Automatically exit the domain when calling `domain.dispose()`.
Make sure the deletion event gets reported in the following scenario:
1. Watch a file.
2. The initial stat() goes okay.
3. Something deletes the watched file.
4. The second stat() fails with ENOENT.
The second stat() translates into the first 'change' event but a logic error
stopped it from getting emitted.
Fixes#4027.
This commit changes the default value of the rejectUnauthorized option from
false to true.
What that means is that tls.connect(), https.get() and https.request() will
reject invalid server certificates from now on, including self-signed
certificates.
There is an escape hatch: if you set the NODE_TLS_REJECT_UNAUTHORIZED
environment variable to the literal string "0", node.js reverts to its
old behavior.
Fixes#3949.
A HTTP/1.0 client does not support 'Transfer-Encoding: chunked' unless it
explicitly requests it by sending a 'TE: chunked' header.
Before this commit, node.js always disabled chunked encoding for HTTP/1.0
clients. Now it will scan for the TE header and turn on chunked encoding if
requested and applicable.
Fixes#940.
With this patch the IPC socket is no longer available in the
ChildProcess.stdio array. This shouldn't be very problematic, since
this socket was effectively non-functional; it would never emit any
events.
Throw an exception in the tls.Server constructor when the options object
doesn't contain either a PFX or a key/certificate combo.
Said change exposed a bug in simple/test-tls-junk-closes-server. Addressed.
Fixes#3941.
It takes an optional "expected exception" argument that is not used meaningfully
but is nevertheless documented. Undocument it, it confuses casual readers of the
documentation.
Fixes#3935.
Update the default cipher list from RC4-SHA:AES128-SHA:AES256-SHA
to ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH
in order to mitigate BEAST attacks.
The documentation suggested AES256-SHA but unfortunately that's a CBC cipher
and therefore susceptible to attacks.
Fixes#3900.
Ensure that the delay >= 0 when detaching the timer from the queue. Fixes the
following assertion:
uv_timer_start: Assertion `timeout >= 0' failed.
No test included, it's timing sensitive.
Commit 4e5fe2d changed the way how process.nextTick() works:
process.nextTick(function foo() {
process.nextTick(function bar() {
// ...
});
});
Before said commit, foo() and bar() used to run on separate event loop ticks
but that is no longer the case.
However, that's exactly the behavior that the TLS renegotiation attack guard
relies on. It gets called by OpenSSL and needs to defer the 'error' event to a
later tick because the default action is to destroy the TLS context - the same
context that OpenSSL currently operates on.
When things change underneath your feet, bad things happen and OpenSSL is no
exception. Ergo, use setImmediate() instead of process.nextTick() to ensure
that the 'error' event is actually emitted at a later tick.
Fixes#3840.
Fixes a minor oversight introduced in 168a555, resulting in the following error:
fs.js:467
return fs.ftruncateSync(path, len, callback);
^
ReferenceError: callback is not defined
at Object.fs.truncateSync (fs.js:467:40)
This commit reverts the following commits (in reverse chronological order):
74d076c errnoException must be done immediately
ddb02b9 net: support Server.listen(Pipe)
085a098 cluster: do not use internal server API
d138875 net: lazy listen on handler
Commit d138875 introduced a backwards incompatible change that broke the
simple/test-net-socket-timeout and simple/test-net-lazy-listen tests - it
defers listening on the target port until the `net.Server` instance has at
least one 'connection' event listener.
The other patches had to be reverted in order to revert d138875.
Fixes#3832.
The destroy() method of fs.ReadStream and fs.WriteStream takes a callback.
It's a leftover from the node 0.1 days, undocumented and not part of the
streams API. Remove it.
Previously, a command with a short stdio array would result in the child's
stdout and stderr objects set to null. For example:
var c = child_process.spawn(cmd, args, {stdio: ['pipe']});
// results in c.stdout === null.
The expected behavior is the above line functioning the same as this one:
var c = child_process.spawn(cmd, args, {stdio: ['pipe', null, null]});
// provides correct (non-null) c.stdout; as does the above, after this fix.
This fixes the problem that calling pause() on a socket would not
actually prevent 'data' events from being emitted. It also replaces
the existing test by a more elaborate one.
Ref: #3118
Problem: calling `server.listen()` (no port) on a net.Server triggered the
following libuv assertion:
node: ../deps/uv/src/unix/stream.c:406: uv__write: Assertion `fd_to_send >= 0'
failed.
Cause: uv_tcp_t handles are lazily initialized. Omitting the port made the
handle get initialized even more lazily. Too lazily - it wasn't initialized
when the handle was sent over to the child process.
Solution: implicitly bind to a random port in listen() when the port number
is omitted, it forces the handle to initialize. This is not a change in
behavior, listen() has always been identical to listen(0).
Fixes#3325.
AssertionError already inherits from Error above using util.inherits(),
so this extra line was redundant.
test/simple/test-assert.js already tests for `instanceof`, and still passes.
This is rewrite of #3701 and #3603 before.
This patch introduce `util.inspect.styles`
and `util.inspect.colors` objects, which enables customization
of color sequences.
This reverts commit 928ea564d1.
Keeping the original Array instance in-place essentially causes a memory leak
on EventEmitters that use an infinite number of event names (an incrementing
counter, for example), which isn't an unreasonable thing to want to do.
Fixes#3702.
Before this commit, `fs.unwatchFile(path)` removed *all* listeners for `path`.
The function is overloaded now: `fs.unwatchFile(path)` still removes all
listeners, but `fs.unwatchFile(path, cb)` lets you remove a specific listener.
Fixes#3660.
Don't use the double-negate trick to coalesce the timeout argument into a
number, it produces the wrong result for very large timeouts.
Example:
setTimeout(cb, 1e10); // doesn't work, ~~1e10 == 1410065408
Wrong order of operands was causing problems while trying to use command
buffering:
> {
... a: 3,
...
repl.js:284
if (cmd.trim().match(/^npm /) && !self.bufferedCommand) {
^
TypeError: Cannot call method 'trim' of undefined
at finish (repl.js:284:17)
at REPLServer.self.eval (repl.js:118:5)
at rli.on.e (repl.js:260:20)
at REPLServer.self.eval (repl.js:118:5)
at Interface.<anonymous> (repl.js:250:12)
at Interface.EventEmitter.emit (events.js:88:17)
at Interface._onLine (readline.js:183:10)
at Interface._line (readline.js:502:8)
at Interface._ttyWrite (readline.js:720:14)
at ReadStream.<anonymous> (readline.js:105:12)
Test included.
Closes#3515.
Closes#3517.
Closes#3621.
There is no need for fs.readFile() to be using pread rather than read.
The default semantics of read() are such that subsequent reads are where
we want them anyway.
Make CLIENT_RENEG_LIMIT inclusive instead of exclusive, i.e. a limit of 2
means the peer can renegotiate twice, not just once.
Update pummel/test-tls-ci-reneg-attack accordingly and make it less timing
sensitive (and run faster) while we're at it.
Fix#3455.
The remoteAddress and remotePort properties are
dynamically retrieved from _getpeername().
While _getpeername() checks if the _handle is
null, it is also possible for the tcp_wrapped
_handle.getpeername() to return null on error.
Such a condition happens when the remote closes
and one of these properties is accessed before
_handle is set to null.
* V8: Upgrade to v3.11.10
* npm: Upgrade to 1.1.26
* doc: Improve cross-linking in API docs markdown (Ben Kelly)
* Fix#3425: removeAllListeners should delete array (Reid Burke)
* cluster: don't silently drop messages when the write queue gets big (Bert Belder)
* Add Buffer.concat method (isaacs)
* windows: make symlinks tolerant to forward slashes (Bert Belder)
* build: Add node.d and node.1 to installer (isaacs)
* cluster: rename worker.unqiueID to worker.id (Andreas Madsen)
* Windows: Enable ETW events on Windows for existing DTrace probes. (Igor Zinkovsky)
* test: bundle node-weak in test/gc so that it doesn't need to be downloaded (Nathan Rajlich)
* Make many tests pass on Windows (Bert Belder)
* Fix#3388 Support listening on file descriptors (isaacs)
* Fix#3407 Add os.tmpDir() (isaacs)
* Unbreak the snapshotted build on Windows (Bert Belder)
* Clean up child_process.kill throws (Bert Belder)
* crypto: make cipher/decipher accept buffer args (Ben Noordhuis)
When removeAllListeners is called, the listeners array
is deleted to maintain compatibility with v0.6.
Reverts "events: don't delete the listeners array"
This reverts commit 78dc13fbf9.
Conflicts:
test/simple/test-event-emitter-remove-all-listeners.js
Bert Belder
isaacs
Soarez
Nathan Rajlich
Ben Noordhuis
Aaditya Bhatia
Ricky Ng-Adam
koichik
Paul Serby
Fedor Indutny
Alex Kocharin
Pavel Lang
thewilli
Andreas Madsen
tasogarepg
Frédéric Germain
Shigeki Ohtsu
Brian White
Timothy J Fontaine
Felix Böhm
Josh Erickson
Dominic Tarr
Tyler Neylon
Gil Pedersen
Tom Hughes-Croucher
Joe Andaverde
Brian White
Toshihiro Nakamura
Jonas Westerlund
TJ Holowaychuk
Tim Macfarlane
Vladimir Beloborodov
Maciej Małecki
Mathias Bynens
Karl Skomski
Reid Burke
ssuda