gitroo-admin/node
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
node/lib/internal
History
Exact
Tobias Nießen 19873abfb2
 crypto,tls: implement safe x509 GeneralName format 
This change introduces JSON-compatible escaping rules for strings that
include X.509 GeneralName components (see RFC 5280). This non-standard
format avoids ambiguities and prevents injection attacks that could
previously lead to X.509 certificates being accepted even though they
were not valid for the target hostname.

These changes affect the format of subject alternative names and the
format of authority information access. The checkServerIdentity function
has been modified to safely handle the new format, eliminating the
possibility of injecting subject alternative names into the verification
logic.

Because each subject alternative name is only encoded as a JSON string
literal if necessary for security purposes, this change will only be
visible in rare cases.

This addresses CVE-2021-44532.

Co-authored-by: Akshay K <iit.akshay@gmail.com>
CVE-ID: CVE-2021-44532
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/306
PR-URL: https://github.com/nodejs-private/node-private/pull/300
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
2022-01-07 16:30:54 +00:00
..
assert assert: port common.mustCall() to assert 2020-09-15 21:39:03 +01:00
bootstrap worker: allow passing JS wrapper objects via postMessage 2020-09-27 12:32:00 +02:00
child_process child_process: retain reference to data with advanced serialization 2021-12-14 15:32:22 +00:00
cluster lib: refactored scheduling policy assignment 2020-06-07 09:34:11 -07:00
console console: fix prototype pollution via console.table 2022-01-07 12:04:42 +00:00
crypto crypto: simplify KeyObject constructor 2020-09-28 10:59:33 +02:00
dns dns: make dns.Resolver timeout configurable 2020-07-08 14:23:38 -07:00
fs fs: add .ref() and .unref() methods to watcher classes 2020-11-16 11:57:49 -05:00
http2 http2: add unknownProtocol timeout 2021-02-22 17:16:43 +00:00
main repl: support --loader option in builtin REPL 2020-09-29 00:02:24 +02:00
modules lib: fix regular expression to detect / and \ 2021-12-14 15:35:05 +00:00
per_context lib: add URI handling functions to primordials 2021-03-29 12:33:50 +01:00
policy lib: improve debuglog() performance 2020-09-28 10:59:37 +02:00
process lib: use remaining typed arrays from primordials 2020-11-16 11:57:59 -05:00
readline util: improve unicode support 2020-04-28 16:00:36 +02:00
repl lib: improve debuglog() performance 2020-09-28 10:59:37 +02:00
source_map lib: improve debuglog() performance 2020-09-28 10:59:37 +02:00
streams lib: use remaining typed arrays from primordials 2020-11-16 11:57:59 -05:00
test src: replace heap_utils.createHeapSnapshot with v8.getHeapSnapshot 2019-03-19 01:04:51 +08:00
util lib: use remaining typed arrays from primordials 2020-11-16 11:57:59 -05:00
vm vm: throw error when duplicated exportNames in SyntheticModule 2020-05-13 17:52:55 +02:00
worker lib: improve debuglog() performance 2020-09-28 10:59:37 +02:00
assert.js benchmark,doc,lib,test: prepare for padding lint rule 2019-12-17 17:07:01 -05:00
async_hooks.js async_hooks: fix resource stack for deep stacks 2020-09-22 19:53:37 +02:00
buffer.js lib: use remaining typed arrays from primordials 2020-11-16 11:57:59 -05:00
child_process.js lib: use remaining typed arrays from primordials 2020-11-16 11:57:59 -05:00
cli_table.js util: improve unicode support 2020-04-28 16:00:36 +02:00
constants.js lib: replace charCodeAt with fixed Unicode 2020-07-14 12:13:22 -07:00
dgram.js lib: replace Symbol global by the primordials Symbol 2020-02-06 02:49:22 +00:00
dtrace.js lib: move DTRACE_* probes out of global scope 2019-03-12 14:19:36 +00:00
encoding.js lib: use remaining typed arrays from primordials 2020-11-16 11:57:59 -05:00
error_serdes.js internal: rename error-serdes for consistency 2020-09-28 10:59:38 +02:00
errors.js crypto,tls: implement safe x509 GeneralName format 2022-01-07 16:30:54 +00:00
fixed_queue.js lib: unnecessary const assignment for class 2020-05-13 17:52:50 +02:00
freelist.js lib: flatten access to primordials 2020-02-06 02:49:21 +00:00
freeze_intrinsics.js bootstrap: correct --frozen-intrinsics override fix 2020-09-22 19:56:54 +02:00
heap_utils.js worker: add ability to take heap snapshot from parent thread 2020-04-28 16:00:46 +02:00
histogram.js perf,src: add HistogramBase and internal/histogram.js 2020-04-20 21:49:18 +02:00
http.js lib: replace Symbol global by the primordials Symbol 2020-02-06 02:49:22 +00:00
idna.js lib: convert legacy process.binding to internalBinding 2019-02-18 07:21:48 +01:00
inspector_async_hook.js lib: replace Set global by the primordials 2020-02-06 02:49:24 +00:00
js_stream_socket.js lib: improve debuglog() performance 2020-09-28 10:59:37 +02:00
linkedlist.js
net.js net: allow wider regex in interface name 2020-09-22 19:53:48 +02:00
options.js src: allow embedders to disable esm loader 2020-09-23 22:34:06 +02:00
priority_queue.js lib: replace Symbol global by the primordials Symbol 2020-02-06 02:49:22 +00:00
querystring.js querystring: improve stringify() performance 2020-07-14 12:13:19 -07:00
readme.md
repl.js lib: enforce use of primordial Number 2020-02-06 02:49:22 +00:00
socket_list.js benchmark,lib: change var to const 2019-03-30 13:16:39 +01:00
stream_base_commons.js lib: use full URL to GitHub issues in comments 2020-11-16 11:57:53 -05:00
timers.js lib: improve debuglog() performance 2020-09-28 10:59:37 +02:00
tls.js tls: for...of in _tls_common.js 2020-02-06 02:49:31 +00:00
trace_events_async_hooks.js lib: replace charCodeAt with fixed Unicode 2020-07-14 12:13:22 -07:00
tty.js lib: replace http to https of comment link urls 2020-09-22 10:21:10 +02:00
url.js lib: add URI handling functions to primordials 2021-03-29 12:33:50 +01:00
util.js util: use a global symbol for util.promisify.custom 2020-04-02 00:47:42 -04:00
v8_prof_polyfill.js lib: replace use of Error with primordials 2020-02-06 02:49:24 +00:00
v8_prof_processor.js lib: flatten access to primordials 2020-02-06 02:49:21 +00:00
validators.js lib: fix validateport error message when allowZero is false 2020-05-13 17:52:56 +02:00
watchdog.js src,lib: make ^C print a JS stack trace 2020-04-28 16:00:39 +02:00
worker.js worker: add eventLoopUtilization() 2021-03-16 00:04:09 +00:00

readme.md

Internal Modules

The modules in lib/internal are intended for internal use in Node.js core only, and are not accessible with require() from user modules. These modules can be changed at any time. Reliance on these modules outside of core is not supported in any way.