Skip to content

Commit bc48ffd

Browse files
marco-ippolitomarco-ippolito
authored
Merge branch 'nodejs:main' into main
2 parents 19684f8 + 9602664 commit bc48ffd

File tree

1,551 files changed

+81766
-31996
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,551 files changed

+81766
-31996
lines changed

‎.github/workflows/tools.yml

+16
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,22 @@ jobs:
109109
echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_ENV
110110
./tools/update-acorn-walk.sh
111111
fi
112+
- id: libuv
113+
subsystem: deps
114+
label: dependencies
115+
run: |
116+
NEW_VERSION=$(gh api repos/libuv/libuv/releases/latest -q '.tag_name|ltrimstr("v")')
117+
VERSION_H="./deps/uv/include/uv/version.h"
118+
CURRENT_MAJOR_VERSION=$(grep "#define UV_VERSION_MAJOR" $VERSION_H | sed -n "s/^.*MAJOR \(.*\)/\1/p")
119+
CURRENT_MINOR_VERSION=$(grep "#define UV_VERSION_MINOR" $VERSION_H | sed -n "s/^.*MINOR \(.*\)/\1/p")
120+
CURRENT_PATCH_VERSION=$(grep "#define UV_VERSION_PATCH" $VERSION_H | sed -n "s/^.*PATCH \(.*\)/\1/p")
121+
CURRENT_SUFFIX_VERSION=$(grep "#define UV_VERSION_SUFFIX" $VERSION_H | sed -n "s/^.*SUFFIX \"\(.*\)\"/\1/p")
122+
SUFFIX_STRING=$([[ -z "$CURRENT_SUFFIX_VERSION" ]] && echo "" || echo "-$CURRENT_SUFFIX_VERSION")
123+
CURRENT_VERSION="$CURRENT_MAJOR_VERSION.$CURRENT_MINOR_VERSION.$CURRENT_PATCH_VERSION$SUFFIX_STRING"
124+
if [ "$NEW_VERSION" != "$CURRENT_VERSION" ]; then
125+
echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_ENV
126+
./tools/dep_updaters/update-libuv.sh "$NEW_VERSION"
127+
fi
112128
steps:
113129
- uses: actions/checkout@v3
114130
with:

‎AUTHORS

+7
Original file line numberDiff line numberDiff line change
@@ -3568,5 +3568,12 @@ Obiwac <[email protected]>
35683568
Yu Gu <[email protected]>
35693569
andreysoktoev <[email protected]>
35703570
Pavel Horal <[email protected]>
3571+
Konv <[email protected]>
3572+
Aidan Temple <[email protected]>
3573+
Emanuel Hoogeveen <[email protected]>
3574+
Takuro Sato <[email protected]>
3575+
Carter Snook <[email protected]>
3576+
Nathanael Ruf <[email protected]>
3577+
Vasili Skurydzin <[email protected]>
35713578

35723579
# Generated by tools/update-authors.mjs

‎LICENSE

+14-2
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,18 @@ The externally maintained libraries used by Node.js are:
107107
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
108108
"""
109109

110+
- ittapi, located at deps/v8/third_party/ittapi, is licensed as follows:
111+
"""
112+
Copyright (c) 2019 Intel Corporation. All rights reserved.
113+
114+
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
115+
116+
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
117+
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
118+
3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
119+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
120+
"""
121+
110122
- ICU, located at deps/icu-small, is licensed as follows:
111123
"""
112124
UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE
@@ -1040,9 +1052,9 @@ The externally maintained libraries used by Node.js are:
10401052
- zlib, located at deps/zlib, is licensed as follows:
10411053
"""
10421054
zlib.h -- interface of the 'zlib' general purpose compression library
1043-
version 1.2.11, January 15th, 2017
1055+
version 1.2.13, October 13th, 2022
10441056

1045-
Copyright (C) 1995-2017 Jean-loup Gailly and Mark Adler
1057+
Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler
10461058

10471059
This software is provided 'as-is', without any express or implied
10481060
warranty. In no event will the authors be held liable for any damages

‎README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -444,7 +444,7 @@ For information about the governance of the Node.js project, see
444444
**Rich Trott** <<[email protected]>> (he/him)
445445
* [vdeturckheim](https://github.com/vdeturckheim) -
446446
**Vladimir de Turckheim** <<[email protected]>> (he/him)
447-
* [VoltrexMaster](https://github.com/VoltrexMaster) -
447+
* [VoltrexKeyva](https://github.com/VoltrexKeyva) -
448448
**Mohammed Keyvanzadeh** <<[email protected]>> (he/him)
449449
* [watilde](https://github.com/watilde) -
450450
**Daijiro Wachi** <<[email protected]>> (he/him)
@@ -690,7 +690,7 @@ maintaining the Node.js project.
690690
**Pooja Durgad** <<[email protected]>>
691691
* [RaisinTen](https://github.com/RaisinTen) -
692692
**Darshan Sen** <<[email protected]>>
693-
* [VoltrexMaster](https://github.com/VoltrexMaster) -
693+
* [VoltrexKeyva](https://github.com/VoltrexKeyva) -
694694
**Mohammed Keyvanzadeh** <<[email protected]>> (he/him)
695695

696696
Triagers follow the [Triage Guide](./doc/contributing/issues.md#triaging-a-bug-report) when

‎SECURITY.md

+126
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,132 @@ Here is the security disclosure policy for Node.js
5555
the release process above to ensure that the disclosure is handled in a
5656
consistent manner.
5757

58+
## The Node.js threat model
59+
60+
In the Node.js threat model, there are trusted elements such as the
61+
underlying operating system. Vulnerabilities that require the compromise
62+
of these trusted elements are outside the scope of the Node.js threat
63+
model.
64+
65+
For a vulnerability to be eligible for a bug bounty, it must be a
66+
vulnerability in the context of the Node.js threat model. In other
67+
words, it cannot assume that a trusted element (such as the operating
68+
system) has been compromised.
69+
70+
Being able to cause the following through control of the elements that Node.js
71+
does not trust is considered a vulnerability:
72+
73+
* Disclosure or loss of integrity or confidentiality of data protected through
74+
the correct use of Node.js APIs.
75+
* The unavailability of the runtime, including the unbounded degradation of its
76+
performance.
77+
78+
If Node.js loads configuration files or runs code by default (without a
79+
specific request from the user), and this is not documented, it is considered a
80+
vulnerability.
81+
Vulnerabilities related to this case may be fixed by a documentation update.
82+
83+
**Node.js does NOT trust**:
84+
85+
1. The data from network connections that are created through the use of Node.js
86+
APIs and which is transformed/validated by Node.js before being passed to the
87+
application. This includes:
88+
* HTTP APIs (all flavors) client and server APIs.
89+
* DNS APIs.
90+
2. Consumers of data protected through the use of Node.js APIs (for example
91+
people who have access to data encrypted through the Node.js crypto APIs).
92+
3. The file content or other I/O that is opened for reading or writing by the
93+
use of Node.js APIs (ex: stdin, stdout, stderr).
94+
95+
In other words, if the data passing through Node.js to/from the application
96+
can trigger actions other than those documented for the APIs, there is likely
97+
a security vulnerability. Examples of unwanted actions are polluting globals,
98+
causing an unrecoverable crash, or any other unexpected side effects that can
99+
lead to a loss of confidentiality, integrity, or availability.
100+
101+
**Node.js trusts everything else**. As some examples this includes:
102+
103+
1. The developers and infrastructure that runs it.
104+
2. The operating system that Node.js is running under and its configuration,
105+
along with anything under control of the operating system.
106+
3. The code it is asked to run including JavaScript and native code, even if
107+
said code is dynamically loaded, e.g. all dependencies installed from the
108+
npm registry.
109+
The code run inherits all the privileges of the execution user.
110+
4. Inputs provided to it by the code it is asked to run, as it is the
111+
responsibility of the application to perform the required input validations.
112+
5. Any connection used for inspector (debugger protocol) regardless of being
113+
opened by command line options or Node.js APIs, and regardless of the remote
114+
end being on the local machine or remote.
115+
6. The file system when requiring a module.
116+
See <https://nodejs.org/api/modules.html#all-together>.
117+
118+
Any unexpected behavior from the data manipulation from Node.js Internal
119+
functions are considered a vulnerability.
120+
121+
In addition to addressing vulnerabilities based on the above, the project works
122+
to avoid APIs and internal implementations that make it "easy" for application
123+
code to use the APIs incorrectly in a way that results in vulnerabilities within
124+
the application code itself. While we don’t consider those vulnerabilities in
125+
Node.js itself and will not necessarily issue a CVE we do want them to be
126+
reported privately to Node.js first.
127+
We often choose to work to improve our APIs based on those reports and issue
128+
fixes either in regular or security releases depending on how much of a risk to
129+
the community they pose.
130+
131+
### Examples of vulneratibities
132+
133+
#### Improper Certificate Validation (CWE-295)
134+
135+
* Node.js provides APIs to validate handling of Subject Alternative Names (SANs)
136+
in certficates used to connect to a TLS/SSL endpoint. If certificates can be
137+
crafted which result in incorrect validation by the Node.js APIs that is
138+
considered a vulnerability.
139+
140+
#### Inconsistent Interpretation of HTTP Requests (CWE-444)
141+
142+
* Node.js provides APIs to accept http connections. Those APIs parse the
143+
headers received for a connection and pass them on to the application.
144+
Bugs in parsing those headers which can result in request smuggling are
145+
considered vulnerabilities.
146+
147+
#### Missing Cryptographic Step (CWE-325)
148+
149+
* Node.js provides APIs to encrypt data. Bugs that would allow an attacker
150+
to get the original data without requiring the decryption key are
151+
considered vulnerabilities.
152+
153+
#### External Control of System or Configuration Setting (CWE-15)
154+
155+
* If Node.js automatically loads a configuration file which is not documented
156+
and modification of that configuration can affect the confidentiality of
157+
data protected using the Node.js APIs this is considered a vulnerability.
158+
159+
### Examples of non-vulneratibities
160+
161+
#### Malicious Third-Party Modules (CWE-1357)
162+
163+
* Code is trusted by Node.js, therefore any scenario that requires a malicious
164+
third-party module cannot result in a vulnerability in Node.js.
165+
166+
#### Prototype Pollution Attacks (CWE-1321)
167+
168+
* Node.js trusts the inputs provided to it by application code.
169+
It is up to the application to sanitize appropriately, therefore any scenario
170+
that requires control over user input is not considered a vulnerability.
171+
172+
#### Uncontrolled Search Path Element (CWE-427)
173+
174+
* Node.js trusts the file system in the environment accessible to it.
175+
Therefore, it is not a vulnerability if it accesses/loads files from any path
176+
that is accessible to it.
177+
178+
#### External Control of System or Configuration Setting (CWE-15)
179+
180+
* If Node.js automatically loads a configuration file which is documented
181+
no scenario that requires modification of that configuration file is
182+
considered a vulnerability.
183+
58184
## Receiving security updates
59185

60186
Security notifications will be distributed via the following methods.

‎benchmark/util/text-encoder.js

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
'use strict';
2+
3+
const common = require('../common.js');
4+
5+
const BASE = 'string\ud801';
6+
7+
const bench = common.createBenchmark(main, {
8+
len: [256, 1024, 1024 * 32],
9+
n: [1e4],
10+
op: ['encode', 'encodeInto']
11+
});
12+
13+
function main({ n, op, len }) {
14+
const encoder = new TextEncoder();
15+
const input = BASE.repeat(len);
16+
const subarray = new Uint8Array(len);
17+
18+
bench.start();
19+
switch (op) {
20+
case 'encode': {
21+
for (let i = 0; i < n; i++)
22+
encoder.encode(input);
23+
break;
24+
}
25+
case 'encodeInto': {
26+
for (let i = 0; i < n; i++)
27+
encoder.encodeInto(input, subarray);
28+
break;
29+
}
30+
}
31+
bench.end(n);
32+
}

‎benchmark/v8/serialize.js

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
'use strict';
2+
3+
const common = require('../common.js');
4+
const v8 = require('v8');
5+
6+
const bench = common.createBenchmark(main, {
7+
len: [256, 1024 * 16, 1024 * 512],
8+
n: [1e6]
9+
});
10+
11+
function main({ n, len }) {
12+
const typedArray = new BigUint64Array(len);
13+
bench.start();
14+
for (let i = 0; i < n; i++)
15+
v8.serialize({ a: 1, b: typedArray });
16+
bench.end(n);
17+
}

‎common.gypi

+2-6
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636

3737
# Reset this number to 0 on major V8 upgrades.
3838
# Increment by one for each non-official patch applied to deps/v8.
39-
'v8_embedder_string': '-node.19',
39+
'v8_embedder_string': '-node.7',
4040

4141
##### V8 defaults for Node.js #####
4242

@@ -283,11 +283,7 @@
283283
'-std:c++17'
284284
],
285285
'BufferSecurityCheck': 'true',
286-
'target_conditions': [
287-
['_toolset=="target"', {
288-
'DebugInformationFormat': 1 # /Z7 embed info in .obj files
289-
}],
290-
],
286+
'DebugInformationFormat': 1, # /Z7 embed info in .obj files
291287
'ExceptionHandling': 0, # /EHsc
292288
'MultiProcessorCompilation': 'true',
293289
'StringPooling': 'true', # pool string literals

‎configure.py

+16
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,13 @@
160160
help="Generate an executable with libgcc and libstdc++ libraries. This "
161161
"will not work on OSX when using the default compilation environment")
162162

163+
parser.add_argument("--enable-vtune-profiling",
164+
action="store_true",
165+
dest="enable_vtune_profiling",
166+
help="Enable profiling support for Intel VTune profiler to profile "
167+
"JavaScript code executed in Node.js. This feature is only available "
168+
"for x32, x86, and x64 architectures.")
169+
163170
parser.add_argument("--enable-pgo-generate",
164171
action="store_true",
165172
dest="enable_pgo_generate",
@@ -1280,6 +1287,15 @@ def configure_node(o):
12801287
if flavor == 'aix':
12811288
o['variables']['node_target_type'] = 'static_library'
12821289

1290+
if target_arch in ('x86', 'x64', 'ia32', 'x32'):
1291+
o['variables']['node_enable_v8_vtunejit'] = b(options.enable_vtune_profiling)
1292+
elif options.enable_vtune_profiling:
1293+
raise Exception(
1294+
'The VTune profiler for JavaScript is only supported on x32, x86, and x64 '
1295+
'architectures.')
1296+
else:
1297+
o['variables']['node_enable_v8_vtunejit'] = 'false'
1298+
12831299
if flavor != 'linux' and (options.enable_pgo_generate or options.enable_pgo_use):
12841300
raise Exception(
12851301
'The pgo option is supported only on linux.')

‎deps/base64/base64/CMakeLists.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ if (POLICY CMP0127)
1717
cmake_policy(SET CMP0127 NEW)
1818
endif()
1919

20-
project(base64 LANGUAGES C VERSION 0.4.0)
20+
project(base64 LANGUAGES C VERSION 0.5.0)
2121

2222
include(GNUInstallDirs)
2323
include(CMakeDependentOption)

‎deps/v8/.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -122,3 +122,4 @@ bazel-v8
122122
/third_party/zlib/contrib/bench
123123
/third_party/zlib/contrib/tests
124124
/third_party/zlib/google/test
125+
!/third_party/ittapi

0 commit comments

Comments
 (0)