Exact

Exact Union RegExp

Tobias Nießen 8c2db2c86b tls: fix handling of x509 subject and issuer ... When subject and verifier are represented as strings, escape special characters (such as '+') to guarantee unambiguity. Previously, different distinguished names could result in the same string when encoded. In particular, inserting a '+' in a single-value Relative Distinguished Name (e.g., L or OU) would produce a string that is indistinguishable from a multi-value Relative Distinguished Name. Third-party code that correctly interprets the generated string representation as a multi-value Relative Distinguished Name could then be vulnerable to an injection attack, e.g., when an attacker includes a single-value RDN with type OU and value 'HR + CN=example.com', the string representation produced by unpatched versions of Node.js would be 'OU=HR + CN=example.com', which represents a multi-value RDN. Node.js itself is not vulnerable to this attack because the current implementation that parses such strings into objects does not handle '+' at all. This oversight leads to incorrect results, but at the same time appears to prevent injection attacks (as described above). With this change, the JavaScript objects representing the subject and issuer Relative Distinguished Names are constructed in C++ directly, instead of (incorrectly) encoding them as strings and then (incorrectly) decoding the strings in JavaScript. This addresses CVE-2021-44533. Co-authored-by: Akshay K <iit.akshay@gmail.com> CVE-ID: CVE-2021-44533 Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/306 PR-URL: https://github.com/nodejs-private/node-private/pull/300 Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Rich Trott <rtrott@gmail.com>		2022-01-07 16:31:13 +00:00
..
0-dns	doc: normalize Bash code block info strings	2020-07-08 13:30:06 -07:00
apilinks
b
clustered-server
cycles
es-module-loaders	esm: use "node:" namespace for builtins	2020-11-16 11:57:52 -05:00
es-module-require-cache
es-module-specifiers	module: fix legacy node specifier resolution to resolve "main" field	2021-07-28 23:25:49 +01:00
es-module-url
es-modules	lib: fix regular expression to detect / and \	2021-12-14 15:35:05 +00:00
GH-7131
global
internal-modules
json-with-directory-name-module
keys	tls: drop support for URI alternative names	2022-01-07 16:31:04 +00:00
macos-app-sandbox	src: tolerate EPERM returned from tcsetattr	2020-07-14 12:13:29 -07:00
module-extension-over-directory
module-load-order
module-require
module-require-symlink
nested-index
node_modules	module: exports pattern support	2020-11-16 11:57:51 -05:00
package-main-enoent	test: remove bluebird remnants from test fixture	2020-03-16 19:41:59 -07:00
packages	module: throw an error for invalid package.json main entries	2019-03-27 17:11:53 +01:00
policy	policy: add dependencies map for resources	2019-08-02 22:23:54 +02:00
repl-folder-extensions/foo.js
require-bin
require-empty-main	test: use index.js if package.json "main" is empty	2020-03-30 11:00:28 -07:00
resolve-paths
self_ref_module	module: self referential modules in repl or -r	2020-10-01 11:32:40 -07:00
source-map	test: test cover cases when trace is empty	2019-12-17 17:06:50 -05:00
syntax	esm: phase two of new esm implementation	2019-03-27 15:52:11 -04:00
test-init-index	lib: move DEP0026 to end of life	2019-01-10 08:59:57 -05:00
test-init-native	lib: move DEP0026 to end of life	2019-01-10 08:59:57 -05:00
test-module-loading-globalpaths
test-repl-tab-completion	repl: add autocomplete for filesystem modules	2019-04-29 16:57:34 +02:00
tools/checkimports	tools: fix check-imports.py to match on word boundaries	2020-07-08 13:39:31 -07:00
uncaught-exceptions	test: improve logged errors	2020-04-28 16:00:46 +02:00
v8-coverage	v8: implement v8.stopCoverage()	2021-03-17 20:36:04 +00:00
wasi	test: add wasi test for freopen()	2020-03-16 19:42:00 -07:00
workload	test: remove FIB environment variable from cpu-prof.js	2019-06-18 16:03:13 +02:00
wpt	test: update WPT interfaces and hr-time	2020-06-07 10:32:46 -07:00
x509-escaping	tls: fix handling of x509 subject and issuer	2022-01-07 16:31:13 +00:00
.empty-hidden-repl-history-file
.empty-repl-history-file
.node_repl_history
a.js
aead-vectors.js	crypto: add support for chacha20-poly1305 for AEAD	2018-11-07 18:43:41 -05:00
altdocs.md	tools,doc: fix version picker bug in html.js	2018-11-27 19:14:54 -08:00
assert-first-line.js
assert-long-line.js
async-error.js	process: reduce the number of internal frames in async stack trace	2019-04-29 14:32:29 +02:00
baz.js
catch-stdout-error.js	test: remove unused catch bindings	2018-11-06 10:59:18 -05:00
child-process-echo-options.js	child_process: handle undefined/null for fork() args	2018-11-01 19:41:33 -07:00
child-process-message-and-exit.js
child-process-persistent.js
child-process-spawn-node.js	test: refactoring / cleanup on child-process tests	2020-04-28 16:14:50 +02:00
child_process_should_emit_error.js
cjs-module-wrap.js	module: increase code coverage of cjs loader	2019-07-20 11:13:04 +02:00
cjs-module-wrapper.js	module: increase code coverage of cjs loader	2019-07-20 11:13:04 +02:00
cluster-preload-test.js
cluster-preload.js
debugger-repeat-last.js
debugger-util-regression-fixture.js
define-global.js
deprecated-userland-class.js
deprecated-userland-function.js
deprecated-userland-subclass.js
deprecated.js	lib: move DEP0028 to end of life	2019-01-10 09:00:17 -05:00
destroy-stdin.js
doc_inc_1.md
doc_inc_2.md
doc_with_backticks_in_headings.md	doc: use _Static method_ instead of _Class Method_	2020-09-22 23:48:05 +02:00
doc_with_yaml.md
document_with_links.md	tools: add unified plugin changing links for html docs	2019-12-17 17:07:01 -05:00
document_with_special_heading.md	tools,doc: allow page titles to contain inline code	2020-09-22 19:56:42 +02:00
echo-close-check.js
echo.js
elipses.txt
empty-with-bom.txt
empty.js
empty.txt
esm_loader_not_found_cjs_hint_bare.mjs	esm: improve commonjs hint on module not found	2020-05-13 17:53:02 +02:00
exit.js
experimental.json	esm: phase two of new esm implementation	2019-03-27 15:52:11 -04:00
exports-function-with-param.js
external-repl-module.js	repl: check for NODE_REPL_EXTERNAL_MODULE	2020-02-06 02:48:49 +00:00
failcounter.js
failmustcall1.js
failmustcall2.js
file-to-read-with-bom.txt
file-to-read-without-bom.txt
fixture.ini
foo
GH-892-request.js	test: switch assertEqual arguments	2019-05-31 08:46:52 +02:00
GH-1899-output.js
google_ssl_hello.bin
guess-hash-seed.js	test: refactor min() in test-hash-seed	2019-01-17 16:14:41 -08:00
inspector-global-function.js	test: workaround for V8 8.1 inspector pause issue	2020-04-22 18:00:39 +02:00
intrinsic-mutation.js	bootstrap: run preload prior to frozen-intrinsics	2019-09-03 14:14:04 +02:00
invalid.json
is-object.js
leakedGlobal.js
linux-perf.js	test,v8: skip less and stabilize test-linux-perf.js	2019-06-17 19:49:53 +02:00
loop.js
module-loading-error.node
monkey-patch-run-main.js	module: reduce circular dependency of internal/modules/cjs/loader	2020-02-06 02:49:24 +00:00
net-fd-passing-receiver.js
no-wrapper.js
not-main-module.js
old-repl-history-file-faulty.json
old-repl-history-file-obj.json
openssl_fips_disabled.cnf
openssl_fips_enabled.cnf
order_of_end_tags_5873.md	doc: use _Static method_ instead of _Class Method_	2020-09-22 23:48:05 +02:00
outside.txt	wasi: introduce initial WASI support	2020-02-06 02:49:25 +00:00
overwrite-config-preload-module.js
parent-process-nonpersistent-fork.js	test: test and docs for detached fork process	2018-11-28 11:14:37 -08:00
parent-process-nonpersistent.js
path-resolve.js
path.js
person-large.jpg
person.jpg
person.jpg.br	benchmark,test: add brotli	2019-01-05 21:36:47 +01:00
person.jpg.gz
pkgexports.mjs	module: unify package exports test for CJS and ESM	2019-08-02 22:24:06 +02:00
print A.js	src: allows escaping NODE_OPTIONS with backslashes	2019-04-17 19:46:00 +02:00
print-10-lines.js
print-chars-from-buffer.js
print-chars.js
print-intrinsic-mutation-name.js	bootstrap: run preload prior to frozen-intrinsics	2019-09-03 14:14:04 +02:00
printA.js
printB.js
printC.js
process-exit-code-cases.js
pseudo-multimember-gzip.gz
pseudo-multimember-gzip.z
pss-vectors.json
readfile_pipe_test.txt
recvfd.js
registerExt.hello.world
registerExt.test
registerExt2.test
repl-load-multiline.js
repl-pretty-stack.js
repl-tab-completion-nested-repls.js	repl: improve completion	2020-04-28 16:00:29 +02:00
require-resolve.js	test: refactor common.expectsError	2020-04-01 12:58:33 -04:00
rsa-oaep-test-vectors.js	crypto: add oaepLabel option	2019-09-25 18:20:53 +02:00
sample.png
sample_document.md
semicolon.js
shared-memory.wasm	test: clean up wasm fixtures	2019-01-08 12:57:24 -06:00
shared-memory.wat	test: clean up wasm fixtures	2019-01-08 12:57:24 -06:00
should_exit.js
simple.wasm	test: clean up wasm fixtures	2019-01-08 12:57:24 -06:00
simple.wat	test: clean up wasm fixtures	2019-01-08 12:57:24 -06:00
spawn_closed_stdio.py
test-error-first-line-offset.js
test-fs-readfile-error.js
test-fs-stat-sync-overflow.js
test-resolution-inspect-brk-main.ext	module: ignore resolution failures for inspect-brk	2020-02-06 02:48:55 +00:00
test-resolution-inspect-brk-resolver.js	module: ignore resolution failures for inspect-brk	2020-02-06 02:48:55 +00:00
throws_error.js
throws_error1.js
throws_error2.js
throws_error3.js
throws_error4.js
throws_error5.js
throws_error6.js
throws_error7.js
tls-connect.js	test: fix nits in test/fixtures/tls-connect.js	2019-08-02 22:24:04 +02:00
tls-session-ticket.txt
url-idna.js
url-searchparams.js
url-setter-tests-additional.js
url-tests-additional.js
utf8-bom-shebang-shebang.js	lib: no need to strip BOM or shebang for scripts	2020-02-06 02:48:50 +00:00
utf8-bom-shebang.js	lib: rework logic of stripping BOM+Shebang from commonjs	2020-02-06 02:48:50 +00:00
utf8-bom.js
utf8-bom.json
utf8-shebang-bom.js	lib: rework logic of stripping BOM+Shebang from commonjs	2020-02-06 02:48:50 +00:00
warnings.js
worker-data.cjs	worker: add support for .cjs extension	2020-03-30 10:59:47 -07:00
worker-data.mjs	worker: export workerData to ESM workers	2019-01-30 18:14:38 +01:00
worker-from-argv.js	bootstrap: run preload prior to frozen-intrinsics	2019-09-03 14:14:04 +02:00
worker-script.mjs
x.txt
x1024.txt