RafaelGSS d8ccfe9ad4 policy: handle Module.constructor and main.extensions bypass ...

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/445
Refs: https://hackerone.com/bugs?subject=nodejs&report_id=1960870
Refs: https://hackerone.com/bugs?subject=nodejs&report_id=2043807
CVE-ID: CVE-2023-32002,CVE-2023-32006

2023-08-08 10:00:22 -03:00

..

assert

assert: add assert/strict alias module

2020-06-25 08:37:48 -07:00

dns

dns: make promise API fully constructed from lib/internal/dns/promises

2022-07-31 09:44:57 +02:00

fs

fs: add fs/promises alias module

2020-02-18 22:15:50 -08:00

internal

policy: handle Module.constructor and main.extensions bypass

2023-08-08 10:00:22 -03:00

path

path: add path/posix and path/win32 alias modules

2020-10-20 14:27:31 +00:00

stream

stream: add reduce

2022-04-20 20:34:20 -04:00

timers

timers: propagate signal.reason in awaitable timers

2022-08-01 16:48:36 +02:00

util

util: add util/types alias module

2020-10-21 01:26:34 +02:00

_http_agent.js

http: fix http agent keep alive

2022-07-31 09:44:53 +02:00

_http_client.js

http: trace http request / response

2022-10-11 14:45:11 -05:00

_http_common.js

lib: refactor to avoid unsafe regex primordials

2022-08-02 09:59:01 +02:00

_http_incoming.js

lib: use null-prototype objects for property descriptors

2022-07-31 09:44:45 +02:00

_http_outgoing.js

http: throw error on content-length mismatch

2022-10-11 14:45:26 -05:00

_http_server.js

http: add max for http keepalive

2022-10-11 14:45:14 -05:00

_stream_duplex.js

stream: do not use _stream_* anymore

2021-01-05 19:02:04 +01:00

_stream_passthrough.js

stream: do not use _stream_* anymore

2021-01-05 19:02:04 +01:00

_stream_readable.js

stream: do not use _stream_* anymore

2021-01-05 19:02:04 +01:00

_stream_transform.js

stream: do not use _stream_* anymore

2021-01-05 19:02:04 +01:00

_stream_wrap.js

lib: assign missed deprecation code

2019-03-07 15:48:55 +01:00

_stream_writable.js

stream: do not use _stream_* anymore

2021-01-05 19:02:04 +01:00

_tls_common.js

tools: report unsafe string and regex primordials as lint errors

2022-08-02 09:58:58 +02:00

_tls_wrap.js

net,tls: pass a valid socket on tlsClientError

2022-10-11 14:45:21 -05:00

.eslintrc.yaml

events: expose CustomEvent on global with CLI flag

2022-08-02 10:16:54 +02:00

assert.js

src: disambiguate terms used to refer to builtins and addons

2022-12-08 09:55:24 -05:00

async_hooks.js

lib: use null-prototype objects for property descriptors

2022-07-31 09:44:45 +02:00

buffer.js

buffer: fix atob input validation

2022-10-11 14:45:20 -05:00

child_process.js

child_process: remove lookup of undefined property

2022-10-11 14:45:29 -05:00

cluster.js

lib,src: update cluster to use Parent

2021-01-05 15:41:45 -05:00

console.js

console: split console into global.js and constructor.js

2018-12-02 04:51:18 +08:00

constants.js

lib: flatten access to primordials

2019-11-25 10:28:15 +01:00

crypto.js

tools: add avoid-prototype-pollution lint rule

2022-08-02 09:58:55 +02:00

dgram.js

dgram: add dgram send queue info

2022-11-24 10:26:20 -05:00

diagnostics_channel.js

lib: improved diagnostics_channel subscribe/unsubscribe

2022-07-31 16:57:16 +02:00

dns.js

lib: add diagnostics channel and perf hooks detail

2022-10-11 14:45:15 -05:00

domain.js

domain: fix vm promise tracking while keeping isolation

2022-07-31 16:57:16 +02:00

events.js

events: propagate abortsignal reason in new AbortError ctor in events

2022-08-01 16:48:37 +02:00

fs.js

fs: remove unused option in fs.fstatSync()

2022-10-11 14:45:24 -05:00

http2.js

http2: add support for sensitive headers

2020-07-16 00:25:47 +02:00

http.js

http: make idle http parser count configurable

2022-10-11 14:45:20 -05:00

https.js

https: use kEmptyObject

2022-07-31 09:44:29 +02:00

inspector.js

inspector: expose inspector.close on workers

2022-10-11 14:45:24 -05:00

module.js

module: add API for interacting with source maps

2020-01-14 12:39:06 -08:00

net.js

net,tls: pass a valid socket on tlsClientError

2022-10-11 14:45:21 -05:00

os.js

os: add machine method

2022-10-11 14:45:22 -05:00

path.js

path: change basename() argument from ext to suffix

2022-10-11 14:45:28 -05:00

perf_hooks.js

lib: use null-prototype objects for property descriptors

2022-07-31 09:44:45 +02:00

process.js

src: disambiguate terms used to refer to builtins and addons

2022-12-08 09:55:24 -05:00

punycode.js

punycode: add pending deprecation

2021-07-29 11:56:47 +01:00

querystring.js

lib: include return types in JSDoc

2022-02-01 07:09:50 -05:00

readline.js

readline: refactor to avoid unsafe regex primordials

2022-11-23 12:06:48 -05:00

repl.js

src: disambiguate terms used to refer to builtins and addons

2022-12-08 09:55:24 -05:00

stream.js

lib: use null-prototype objects for property descriptors

2022-07-31 09:44:45 +02:00

string_decoder.js

lib: use null-prototype objects for property descriptors

2022-07-31 09:44:45 +02:00

sys.js

benchmark,doc,lib,test: capitalize comments

2019-03-10 00:44:40 +01:00

test.js

test_runner: support programmatically running --test

2022-12-07 09:04:55 -05:00

timers.js

lib: use null-prototype objects for property descriptors

2022-07-31 09:44:45 +02:00

tls.js

lib: refactor to avoid unsafe regex primordials

2022-08-02 09:59:01 +02:00

trace_events.js

lib: refactor to use validateObject

2021-01-28 12:53:50 +01:00

tty.js

tty: fix TypeError when stream is closed

2022-10-11 14:45:19 -05:00

url.js

url: trim leading and trailing C0 control chars

2022-04-23 22:47:13 -04:00

util.js

lib: refactor to avoid prototype pollution

2022-10-11 14:45:14 -05:00

v8.js

v8: add setHeapSnapshotNearHeapLimit

2022-10-11 14:45:23 -05:00

vm.js

src: merge RunInThisContext() with RunInContext()

2022-07-31 09:45:15 +02:00

wasi.js

wasi: use WasmMemoryObject handle for perf (#43544)

2022-07-31 09:45:00 +02:00

worker_threads.js

worker: add setEnvironmentData/getEnvironmentData

2021-03-15 07:40:26 -07:00

zlib.js

lib: use null-prototype objects for property descriptors

2022-07-31 09:44:45 +02:00