Home Original page

deps: cherry-pick 34880eb3dc from V8 upstream by MylesBorins · Pull Request #8673 · nodejs/node

@MylesBorins added v8 engine

Issues and PRs related to the V8 dependency.

v6.x labels

Sep 20, 2016

@targos targos changed the base branch from master to v6.x-staging

September 22, 2016 12:23 
    Revert of Put RegExp js code in strict mode (patchset nodejs#2 id:20001
    of https://codereview.chromium.org/1776883005/ )

    Reason for revert:
    Found to break SAP Web IDE, and these semantics are not shipped
    in any other browser.
    Revert to legacy semantics while assessing web compatibility.

    BUG=chromium:624318

    Original issue's description:
    > Put RegExp js code in strict mode
    >
    > src/js/regexp.js was one of the few files that was left in sloppy
    > mode. The ES2017 draft specification requires that writes to
    > lastIndex throw when the property is non-writable, and test262
    > tests enforce this behavior. This patch puts that file in strict
    > mode.
    >
    > BUG=v8:4504
    > R=yangguo@chromium.org
    > LOG=Y
    >
    > Committed: https://crrev.com/80b1b2a45bbd9bf3d08e4e6516acfaaa8f438213
    > Cr-Commit-Position: refs/heads/master@{nodejs#34801}

    TBR=yangguo@chromium.org,adamk@chromium.org

    Review-Url: https://codereview.chromium.org/2112713003
    Cr-Commit-Position: refs/heads/master@{nodejs#37449}

MylesBorins pushed a commit that referenced this pull request

Sep 23, 2016 
Original commit message:

    Revert of Put RegExp js code in strict mode (patchset #2 id:20001
    of https://codereview.chromium.org/1776883005/ )

    Reason for revert:
    Found to break SAP Web IDE, and these semantics are not shipped
    in any other browser.
    Revert to legacy semantics while assessing web compatibility.

    BUG=chromium:624318

    Original issue's description:
    > Put RegExp js code in strict mode
    >
    > src/js/regexp.js was one of the few files that was left in sloppy
    > mode. The ES2017 draft specification requires that writes to
    > lastIndex throw when the property is non-writable, and test262
    > tests enforce this behavior. This patch puts that file in strict
    > mode.
    >
    > BUG=v8:4504
    > R=yangguo@chromium.org
    > LOG=Y
    >
    > Committed: https://crrev.com/80b1b2a45bbd9bf3d08e4e6516acfaaa8f438213
    > Cr-Commit-Position: refs/heads/master@{#34801}

    TBR=yangguo@chromium.org,adamk@chromium.org

    Review-Url: https://codereview.chromium.org/2112713003
    Cr-Commit-Position: refs/heads/master@{#37449}

PR-URL: #8673
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

MylesBorins pushed a commit that referenced this pull request

Sep 26, 2016 
Original commit message:

    Revert of Put RegExp js code in strict mode (patchset #2 id:20001
    of https://codereview.chromium.org/1776883005/ )

    Reason for revert:
    Found to break SAP Web IDE, and these semantics are not shipped
    in any other browser.
    Revert to legacy semantics while assessing web compatibility.

    BUG=chromium:624318

    Original issue's description:
    > Put RegExp js code in strict mode
    >
    > src/js/regexp.js was one of the few files that was left in sloppy
    > mode. The ES2017 draft specification requires that writes to
    > lastIndex throw when the property is non-writable, and test262
    > tests enforce this behavior. This patch puts that file in strict
    > mode.
    >
    > BUG=v8:4504
    > R=yangguo@chromium.org
    > LOG=Y
    >
    > Committed: https://crrev.com/80b1b2a45bbd9bf3d08e4e6516acfaaa8f438213
    > Cr-Commit-Position: refs/heads/master@{#34801}

    TBR=yangguo@chromium.org,adamk@chromium.org

    Review-Url: https://codereview.chromium.org/2112713003
    Cr-Commit-Position: refs/heads/master@{#37449}

PR-URL: #8673
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

evanlucas added a commit that referenced this pull request

Sep 28, 2016 
This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable Changes

Semver Minor:

* openssl:
  - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
    CVE-2016-6304 ("OCSP Status Request extension unbounded memory
    growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
    (Shigeki Ohtsu) #8714
  - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
    a crash when using CRLs, CVE-2016-7052.
    (Shigeki Ohtsu) #8786
  - Remove support for loading dynamic third-party engine modules.
    An attacker may be able to hide malicious code to be inserted
    into Node.js at runtime by masquerading as one of the dynamic
    engine modules. Originally reported by Ahmed Zaki (Skype).
    (Ben Noordhuis) https://github.com/nodejs/node-private/pull/73
* http: CVE-2016-5325 - Properly validate for allowable characters in
  the `reason` argument in `ServerResponse#writeHead()`. Fixes a
  possible response splitting attack vector. This introduces a new
  case where `throw` may occur when configuring HTTP responses, users
  should already be adopting try/catch here. Originally reported
  independently by Evan Lucas and Romain Gaucher.
  (Evan Lucas) https://github.com/nodejs/node-private/pull/60

Semver Patch:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
  `Buffer.concat()` while providing a `totalLength` parameter that
  exceeds the total length of the original `Buffer` objects being
  concatenated.
  (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/64
* src: Fix regression where passing an empty password and/or salt to
  crypto.pbkdf2() would cause a fatal error
  (Rich Trott) #8572
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
  check whereby a TLS server may be able to serve an invalid wildcard
  certificate for its hostname due to improper validation of `*.` in the
  wildcard string. Originally reported by Alexander Minozhenko and
  James Bunton (Atlassian).
  (Ben Noordhuis) https://github.com/nodejs/node-private/pull/75
* v8: Fix regression where a regex on a frozen object was broken
  (Myles Borins) #8673

imyller added a commit to imyller/meta-nodejs that referenced this pull request

Sep 28, 2016 
    This is a security release. All Node.js users should consult the
    security release summary at
    https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
    for details on patched vulnerabilities.

    Notable Changes

    Semver Minor:

    * openssl:
      - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
        CVE-2016-6304 ("OCSP Status Request extension unbounded memory
        growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
        (Shigeki Ohtsu) nodejs/node#8714
      - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
        a crash when using CRLs, CVE-2016-7052.
        (Shigeki Ohtsu) nodejs/node#8786
      - Remove support for loading dynamic third-party engine modules.
        An attacker may be able to hide malicious code to be inserted
        into Node.js at runtime by masquerading as one of the dynamic
        engine modules. Originally reported by Ahmed Zaki (Skype).
        (Ben Noordhuis) https://github.com/nodejs/node-private/pull/73
    * http: CVE-2016-5325 - Properly validate for allowable characters in
      the `reason` argument in `ServerResponse#writeHead()`. Fixes a
      possible response splitting attack vector. This introduces a new
      case where `throw` may occur when configuring HTTP responses, users
      should already be adopting try/catch here. Originally reported
      independently by Evan Lucas and Romain Gaucher.
      (Evan Lucas) https://github.com/nodejs/node-private/pull/60

    Semver Patch:

    * buffer: Zero-fill excess bytes in new `Buffer` objects created with
      `Buffer.concat()` while providing a `totalLength` parameter that
      exceeds the total length of the original `Buffer` objects being
      concatenated.
      https://github.com/nodejs/node-private/pull/64
    * src: Fix regression where passing an empty password and/or salt to
      crypto.pbkdf2() would cause a fatal error
      (Rich Trott) nodejs/node#8572
    * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
      check whereby a TLS server may be able to serve an invalid wildcard
      certificate for its hostname due to improper validation of `*.` in the
      wildcard string. Originally reported by Alexander Minozhenko and
      James Bunton (Atlassian).
      (Ben Noordhuis) https://github.com/nodejs/node-private/pull/75
    * v8: Fix regression where a regex on a frozen object was broken
      (Myles Borins) nodejs/node#8673

Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>

imyller added a commit to imyller/meta-nodejs that referenced this pull request

Sep 28, 2016 
    This is a security release. All Node.js users should consult the
    security release summary at
    https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
    for details on patched vulnerabilities.

    Notable Changes

    Semver Minor:

    * openssl:
      - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
        CVE-2016-6304 ("OCSP Status Request extension unbounded memory
        growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
        (Shigeki Ohtsu) nodejs/node#8714
      - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
        a crash when using CRLs, CVE-2016-7052.
        (Shigeki Ohtsu) nodejs/node#8786
      - Remove support for loading dynamic third-party engine modules.
        An attacker may be able to hide malicious code to be inserted
        into Node.js at runtime by masquerading as one of the dynamic
        engine modules. Originally reported by Ahmed Zaki (Skype).
        (Ben Noordhuis) https://github.com/nodejs/node-private/pull/73
    * http: CVE-2016-5325 - Properly validate for allowable characters in
      the `reason` argument in `ServerResponse#writeHead()`. Fixes a
      possible response splitting attack vector. This introduces a new
      case where `throw` may occur when configuring HTTP responses, users
      should already be adopting try/catch here. Originally reported
      independently by Evan Lucas and Romain Gaucher.
      (Evan Lucas) https://github.com/nodejs/node-private/pull/60

    Semver Patch:

    * buffer: Zero-fill excess bytes in new `Buffer` objects created with
      `Buffer.concat()` while providing a `totalLength` parameter that
      exceeds the total length of the original `Buffer` objects being
      concatenated.
      https://github.com/nodejs/node-private/pull/64
    * src: Fix regression where passing an empty password and/or salt to
      crypto.pbkdf2() would cause a fatal error
      (Rich Trott) nodejs/node#8572
    * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
      check whereby a TLS server may be able to serve an invalid wildcard
      certificate for its hostname due to improper validation of `*.` in the
      wildcard string. Originally reported by Alexander Minozhenko and
      James Bunton (Atlassian).
      (Ben Noordhuis) https://github.com/nodejs/node-private/pull/75
    * v8: Fix regression where a regex on a frozen object was broken
      (Myles Borins) nodejs/node#8673

Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>

MylesBorins pushed a commit to MylesBorins/node that referenced this pull request

Oct 4, 2016 
The patch should have been bumped in aafc314 but it was missed.

Ref: nodejs@aafc314
Ref: nodejs#8673

PR-URL: nodejs#8851
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

jasnell pushed a commit that referenced this pull request

Oct 10, 2016 
This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable Changes

Semver Minor:

* openssl:
  - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
    CVE-2016-6304 ("OCSP Status Request extension unbounded memory
    growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
    (Shigeki Ohtsu) #8714
  - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
    a crash when using CRLs, CVE-2016-7052.
    (Shigeki Ohtsu) #8786
  - Remove support for loading dynamic third-party engine modules.
    An attacker may be able to hide malicious code to be inserted
    into Node.js at runtime by masquerading as one of the dynamic
    engine modules. Originally reported by Ahmed Zaki (Skype).
    (Ben Noordhuis) nodejs-private/node-private#73
* http: CVE-2016-5325 - Properly validate for allowable characters in
  the `reason` argument in `ServerResponse#writeHead()`. Fixes a
  possible response splitting attack vector. This introduces a new
  case where `throw` may occur when configuring HTTP responses, users
  should already be adopting try/catch here. Originally reported
  independently by Evan Lucas and Romain Gaucher.
  (Evan Lucas) nodejs-private/node-private#60

Semver Patch:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
  `Buffer.concat()` while providing a `totalLength` parameter that
  exceeds the total length of the original `Buffer` objects being
  concatenated.
  (Сковорода Никита Андреевич) nodejs-private/node-private#64
* src: Fix regression where passing an empty password and/or salt to
  crypto.pbkdf2() would cause a fatal error
  (Rich Trott) #8572
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
  check whereby a TLS server may be able to serve an invalid wildcard
  certificate for its hostname due to improper validation of `*.` in the
  wildcard string. Originally reported by Alexander Minozhenko and
  James Bunton (Atlassian).
  (Ben Noordhuis) nodejs-private/node-private#75
* v8: Fix regression where a regex on a frozen object was broken
  (Myles Borins) #8673