mirrors/node
0
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-10-28 18:25:13 +08:00
Code Activity
Files
v12.x
node/lib/internal
T
History
Tobias NießenandAkshay K 19873abfb2 crypto,tls: implement safe x509 GeneralName format 
This change introduces JSON-compatible escaping rules for strings that
include X.509 GeneralName components (see RFC 5280). This non-standard
format avoids ambiguities and prevents injection attacks that could
previously lead to X.509 certificates being accepted even though they
were not valid for the target hostname.

These changes affect the format of subject alternative names and the
format of authority information access. The checkServerIdentity function
has been modified to safely handle the new format, eliminating the
possibility of injecting subject alternative names into the verification
logic.

Because each subject alternative name is only encoded as a JSON string
literal if necessary for security purposes, this change will only be
visible in rare cases.

This addresses CVE-2021-44532.

Co-authored-by: Akshay K <iit.akshay@gmail.com>
CVE-ID: CVE-2021-44532
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/306
PR-URL: https://github.com/nodejs-private/node-private/pull/300
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
2022-01-07 16:30:54 +00:00
..
assert
assert: port common.mustCall() to assert
2020-09-15 21:39:03 +01:00
bootstrap
worker: allow passing JS wrapper objects via postMessage
2020-09-27 12:32:00 +02:00
child_process
child_process: retain reference to data with advanced serialization
2021-12-14 15:32:22 +00:00
cluster
lib: refactored scheduling policy assignment
2020-06-07 09:34:11 -07:00
console
console: fix prototype pollution via console.table
2022-01-07 12:04:42 +00:00
crypto
crypto: simplify KeyObject constructor
2020-09-28 10:59:33 +02:00
dns
dns: make dns.Resolver timeout configurable
2020-07-08 14:23:38 -07:00
fs
fs: add .ref() and .unref() methods to watcher classes
2020-11-16 11:57:49 -05:00
http2
http2: add unknownProtocol timeout
2021-02-22 17:16:43 +00:00
main
repl: support --loader option in builtin REPL
2020-09-29 00:02:24 +02:00
modules
lib: fix regular expression to detect / and \
2021-12-14 15:35:05 +00:00
per_context
lib: add URI handling functions to primordials
2021-03-29 12:33:50 +01:00
policy
lib: improve debuglog() performance
2020-09-28 10:59:37 +02:00
process
lib: use remaining typed arrays from primordials
2020-11-16 11:57:59 -05:00
readline
util: improve unicode support
2020-04-28 16:00:36 +02:00
repl
lib: improve debuglog() performance
2020-09-28 10:59:37 +02:00
source_map
lib: improve debuglog() performance
2020-09-28 10:59:37 +02:00
streams
lib: use remaining typed arrays from primordials
2020-11-16 11:57:59 -05:00
test
src: replace heap_utils.createHeapSnapshot with v8.getHeapSnapshot
2019-03-19 01:04:51 +08:00
util
lib: use remaining typed arrays from primordials
2020-11-16 11:57:59 -05:00
vm
vm: throw error when duplicated exportNames in SyntheticModule
2020-05-13 17:52:55 +02:00
worker
lib: improve debuglog() performance
2020-09-28 10:59:37 +02:00
assert.js
benchmark,doc,lib,test: prepare for padding lint rule
2019-12-17 17:07:01 -05:00
async_hooks.js
async_hooks: fix resource stack for deep stacks
2020-09-22 19:53:37 +02:00
buffer.js
lib: use remaining typed arrays from primordials
2020-11-16 11:57:59 -05:00
child_process.js
lib: use remaining typed arrays from primordials
2020-11-16 11:57:59 -05:00
cli_table.js
util: improve unicode support
2020-04-28 16:00:36 +02:00
constants.js
lib: replace charCodeAt with fixed Unicode
2020-07-14 12:13:22 -07:00
dgram.js
lib: replace Symbol global by the primordials Symbol
2020-02-06 02:49:22 +00:00
dtrace.js
lib: move DTRACE_* probes out of global scope
2019-03-12 14:19:36 +00:00
encoding.js
lib: use remaining typed arrays from primordials
2020-11-16 11:57:59 -05:00
error_serdes.js
internal: rename error-serdes for consistency
2020-09-28 10:59:38 +02:00
errors.js
crypto,tls: implement safe x509 GeneralName format
2022-01-07 16:30:54 +00:00
fixed_queue.js
lib: unnecessary const assignment for class
2020-05-13 17:52:50 +02:00
freelist.js
lib: flatten access to primordials
2020-02-06 02:49:21 +00:00
freeze_intrinsics.js
bootstrap: correct --frozen-intrinsics override fix
2020-09-22 19:56:54 +02:00
heap_utils.js
worker: add ability to take heap snapshot from parent thread
2020-04-28 16:00:46 +02:00
histogram.js
perf,src: add HistogramBase and internal/histogram.js
2020-04-20 21:49:18 +02:00
http.js
lib: replace Symbol global by the primordials Symbol
2020-02-06 02:49:22 +00:00
idna.js
lib: convert legacy process.binding to internalBinding
2019-02-18 07:21:48 +01:00
inspector_async_hook.js
lib: replace Set global by the primordials
2020-02-06 02:49:24 +00:00
js_stream_socket.js
lib: improve debuglog() performance
2020-09-28 10:59:37 +02:00
linkedlist.js
linkedlist: correct grammar in comments
2017-07-31 08:03:19 +08:00
net.js
net: allow wider regex in interface name
2020-09-22 19:53:48 +02:00
options.js
src: allow embedders to disable esm loader
2020-09-23 22:34:06 +02:00
priority_queue.js
lib: replace Symbol global by the primordials Symbol
2020-02-06 02:49:22 +00:00
querystring.js
querystring: improve stringify() performance
2020-07-14 12:13:19 -07:00
readme.md
doc: clarify text about internal module changes
2018-07-31 08:28:40 +03:00
repl.js
lib: enforce use of primordial Number
2020-02-06 02:49:22 +00:00
socket_list.js
benchmark,lib: change var to const
2019-03-30 13:16:39 +01:00
stream_base_commons.js
lib: use full URL to GitHub issues in comments
2020-11-16 11:57:53 -05:00
timers.js
lib: improve debuglog() performance
2020-09-28 10:59:37 +02:00
tls.js
tls: for...of in _tls_common.js
2020-02-06 02:49:31 +00:00
trace_events_async_hooks.js
lib: replace charCodeAt with fixed Unicode
2020-07-14 12:13:22 -07:00
tty.js
lib: replace http to https of comment link urls
2020-09-22 10:21:10 +02:00
url.js
lib: add URI handling functions to primordials
2021-03-29 12:33:50 +01:00
util.js
util: use a global symbol for util.promisify.custom
2020-04-02 00:47:42 -04:00
v8_prof_polyfill.js
lib: replace use of Error with primordials
2020-02-06 02:49:24 +00:00
v8_prof_processor.js
lib: flatten access to primordials
2020-02-06 02:49:21 +00:00
validators.js
lib: fix validateport error message when allowZero is false
2020-05-13 17:52:56 +02:00
watchdog.js
src,lib: make ^C print a JS stack trace
2020-04-28 16:00:39 +02:00
worker.js
worker: add eventLoopUtilization()
2021-03-16 00:04:09 +00:00

readme.md

Internal Modules

The modules in lib/internal are intended for internal use in Node.js core only, and are not accessible with require() from user modules. These modules can be changed at any time. Reliance on these modules outside of core is not supported in any way.

View Git Blame Copy Permalink