Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

http2: do not allow socket manipulation #16330

Closed
wants to merge 2 commits into from
Closed

http2: do not allow socket manipulation #16330

wants to merge 2 commits into from

Conversation

apapirovski
Copy link
Member

@apapirovski apapirovski commented Oct 20, 2017 •
edited
Loading

This addresses #16252. I still need to update the documentation and potentially the error message but figured the review could get started.

We might need to discuss how much stuff we forbid on the socket, it's possible it's too restrictive currently or perhaps still too permissive.

Checklist
  • make -j4 test (UNIX), or vcbuild test (Windows) passes
  • tests and/or benchmarks are included
  • documentation is changed or added
  • commit message follows commit guidelines
Affected core subsystem(s)

http2, test

@apapirovski apapirovski added the http2 Issues or PRs related to the http2 subsystem. label Oct 20, 2017
@nodejs-github-bot nodejs-github-bot added the lib / src Issues and PRs related to general changes in the lib or src directory. label Oct 20, 2017
jasnell
jasnell reviewed Oct 20, 2017
View reviewed changes
Copy link
Member

@jasnell jasnell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is great. Thank you. Will sign off once the docs are added

lib/internal/http2/core.js Outdated
case 'destroy':
case 'emit':
case 'end':
case 'once':
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Appalling once and on should be ok. The rest of these look good

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stupid autocorrect. Allowing not appalling

@trivikr trivikr mentioned this pull request Oct 23, 2017
Closed
@apapirovski
http2: do not allow socket manipulation
eaa71a1 
Because of the specific serialization and processing
requirements of HTTP/2, sockets should not be
directly manipulated. This forbids any interactions
with destroy, emit, end, once, on, pause, read,
resume and write methods of the socket. It also
redirects setTimeout to session instead of socket.

Fixes: nodejs#16252
Refs: nodejs#16211
@apapirovski
[fixup] add documentation, adjust error message, tweak proxy
5bdb794
@apapirovski
Copy link
Member Author

apapirovski commented Oct 24, 2017 •
edited
Loading

ping @jasnell — would like to get this in 9.0.0 if the doc & other changes look good

(first commit is unchanged, just rebased so had to force push)

@jasnell jasnell added this to the 9.0.0 milestone Oct 24, 2017
@apapirovski
Copy link
Member Author

CI to merge: https://ci.nodejs.org/job/node-test-pull-request/10965/

@apapirovski
Copy link
Member Author

One failure unrelated, going ahead with the merge.

@apapirovski
Copy link
Member Author

Landed in 73533a1

@apapirovski apapirovski deleted the patch-http2-core-socket branch October 25, 2017 16:53
apapirovski added a commit that referenced this pull request Oct 25, 2017
@apapirovski
http2: do not allow socket manipulation
73533a1 
Because of the specific serialization and processing requirements
of HTTP/2, sockets should not be directly manipulated. This
forbids any interactions with destroy, emit, end, pause, read,
resume and write methods of the socket. It also redirects
setTimeout to session instead of socket.

PR-URL: #16330
Fixes: #16252
Refs: #16211
Reviewed-By: James M Snell <jasnell@gmail.com>
addaleax pushed a commit to ayojs/ayo that referenced this pull request Oct 26, 2017
@apapirovski @addaleax
http2: do not allow socket manipulation
e4ed2b0 
Because of the specific serialization and processing requirements
of HTTP/2, sockets should not be directly manipulated. This
forbids any interactions with destroy, emit, end, pause, read,
resume and write methods of the socket. It also redirects
setTimeout to session instead of socket.

PR-URL: nodejs/node#16330
Fixes: nodejs/node#16252
Refs: nodejs/node#16211
Reviewed-By: James M Snell <jasnell@gmail.com>
@jasnell jasnell mentioned this pull request Oct 30, 2017
Merged
gibfahn pushed a commit that referenced this pull request Oct 30, 2017
@apapirovski @gibfahn
http2: do not allow socket manipulation
538e28f 
Because of the specific serialization and processing requirements
of HTTP/2, sockets should not be directly manipulated. This
forbids any interactions with destroy, emit, end, pause, read,
resume and write methods of the socket. It also redirects
setTimeout to session instead of socket.

PR-URL: #16330
Fixes: #16252
Refs: #16211
Reviewed-By: James M Snell <jasnell@gmail.com>
gibfahn pushed a commit that referenced this pull request Oct 30, 2017
@apapirovski @gibfahn
http2: do not allow socket manipulation
84c4c98 
Because of the specific serialization and processing requirements
of HTTP/2, sockets should not be directly manipulated. This
forbids any interactions with destroy, emit, end, pause, read,
resume and write methods of the socket. It also redirects
setTimeout to session instead of socket.

PR-URL: #16330
Fixes: #16252
Refs: #16211
Reviewed-By: James M Snell <jasnell@gmail.com>
gibfahn pushed a commit that referenced this pull request Oct 31, 2017
@apapirovski @gibfahn
http2: do not allow socket manipulation
e6e99eb 
Because of the specific serialization and processing requirements
of HTTP/2, sockets should not be directly manipulated. This
forbids any interactions with destroy, emit, end, pause, read,
resume and write methods of the socket. It also redirects
setTimeout to session instead of socket.

PR-URL: #16330
Fixes: #16252
Refs: #16211
Reviewed-By: James M Snell <jasnell@gmail.com>
@gibfahn gibfahn mentioned this pull request Oct 31, 2017
Merged
MylesBorins pushed a commit that referenced this pull request Oct 31, 2017
@gibfahn @MylesBorins
2017-10-31, Version 8.9.0 'Carbon' (LTS) Release
f5e614a 
This LTS release comes with 87 commits. This includes 30 that are
updates to lib/ or src/, 20 that are test related, 13 that are doc
related, 19 which are build / tools related, and 4 commits which are
updates to dependencies.

Notable Changes:

* doc:
  - add Gibson Fahnestock to Release team (Gibson Fahnestock)
    #16620
* deps:
  - update npm to 5.5.1 (Myles Borins)
    #16509
* http2:
  - The exposed http2 socket is no longer manipulatable
    (Anatoli Papirovski)
    #16330
* module:
  - support custom paths to require.resolve() (cjihrig)
    #16397
* util:
  - util.TextEncoder and util.TextDecoder are no longer experimental.
    There will no longer be a warning when they are used
    (James M Snell)
    #15743

PR-URL: #16630
gibfahn added a commit that referenced this pull request Oct 31, 2017
@gibfahn
2017-10-31, Version 8.9.0 'Carbon' (LTS) Release
f76ce0a 
This LTS release comes with 87 commits. This includes 30 that are
updates to lib/ or src/, 20 that are test related, 13 that are doc
related, 19 which are build / tools related, and 4 commits which are
updates to dependencies.

Notable Changes:

* doc:
  - add Gibson Fahnestock to Release team (Gibson Fahnestock)
    #16620
* deps:
  - update npm to 5.5.1 (Myles Borins)
    #16509
* http2:
  - The exposed http2 socket is no longer manipulatable
    (Anatoli Papirovski)
    #16330
* module:
  - support custom paths to require.resolve() (cjihrig)
    #16397
* util:
  - util.TextEncoder and util.TextDecoder are no longer experimental.
    There will no longer be a warning when they are used
    (James M Snell)
    #15743

PR-URL: #16630
gibfahn added a commit that referenced this pull request Oct 31, 2017
@gibfahn
2017-10-31, Version 8.9.0 'Carbon' (LTS) Release
8025bba 
This LTS release comes with 87 commits. This includes 30 that are
updates to lib/ or src/, 20 that are test related, 13 that are doc
related, 19 which are build / tools related, and 4 commits which are
updates to dependencies.

Notable Changes:

* doc:
  - add Gibson Fahnestock to Release team (Gibson Fahnestock)
    #16620
* deps:
  - update npm to 5.5.1 (Myles Borins)
    #16509
* http2:
  - The exposed http2 socket is no longer manipulatable
    (Anatoli Papirovski)
    #16330
* module:
  - support custom paths to require.resolve() (cjihrig)
    #16397
* util:
  - util.TextEncoder and util.TextDecoder are no longer experimental.
    There will no longer be a warning when they are used
    (James M Snell)
    #15743

PR-URL: #16630
jasnell pushed a commit that referenced this pull request Oct 31, 2017
@gibfahn @jasnell
2017-10-31, Version 8.9.0 'Carbon' (LTS) Release
daa286a 
This LTS release comes with 87 commits. This includes 30 that are
updates to lib/ or src/, 20 that are test related, 13 that are doc
related, 19 which are build / tools related, and 4 commits which are
updates to dependencies.

Notable Changes:

* doc:
  - add Gibson Fahnestock to Release team (Gibson Fahnestock)
    #16620
* deps:
  - update npm to 5.5.1 (Myles Borins)
    #16509
* http2:
  - The exposed http2 socket is no longer manipulatable
    (Anatoli Papirovski)
    #16330
* module:
  - support custom paths to require.resolve() (cjihrig)
    #16397
* util:
  - util.TextEncoder and util.TextDecoder are no longer experimental.
    There will no longer be a warning when they are used
    (James M Snell)
    #15743

PR-URL: #16630
Qard pushed a commit to ayojs/ayo that referenced this pull request Nov 2, 2017
@gibfahn @Qard
2017-10-31, Version 8.9.0 'Carbon' (LTS) Release
781098d 
This LTS release comes with 87 commits. This includes 30 that are
updates to lib/ or src/, 20 that are test related, 13 that are doc
related, 19 which are build / tools related, and 4 commits which are
updates to dependencies.

Notable Changes:

* doc:
  - add Gibson Fahnestock to Release team (Gibson Fahnestock)
    nodejs/node#16620
* deps:
  - update npm to 5.5.1 (Myles Borins)
    nodejs/node#16509
* http2:
  - The exposed http2 socket is no longer manipulatable
    (Anatoli Papirovski)
    nodejs/node#16330
* module:
  - support custom paths to require.resolve() (cjihrig)
    nodejs/node#16397
* util:
  - util.TextEncoder and util.TextDecoder are no longer experimental.
    There will no longer be a warning when they are used
    (James M Snell)
    nodejs/node#15743

PR-URL: nodejs/node#16630
Qard pushed a commit to ayojs/ayo that referenced this pull request Nov 2, 2017
@gibfahn @Qard
2017-10-31, Version 8.9.0 'Carbon' (LTS) Release
ad502ca 
This LTS release comes with 87 commits. This includes 30 that are
updates to lib/ or src/, 20 that are test related, 13 that are doc
related, 19 which are build / tools related, and 4 commits which are
updates to dependencies.

Notable Changes:

* doc:
  - add Gibson Fahnestock to Release team (Gibson Fahnestock)
    nodejs/node#16620
* deps:
  - update npm to 5.5.1 (Myles Borins)
    nodejs/node#16509
* http2:
  - The exposed http2 socket is no longer manipulatable
    (Anatoli Papirovski)
    nodejs/node#16330
* module:
  - support custom paths to require.resolve() (cjihrig)
    nodejs/node#16397
* util:
  - util.TextEncoder and util.TextDecoder are no longer experimental.
    There will no longer be a warning when they are used
    (James M Snell)
    nodejs/node#15743

PR-URL: nodejs/node#16630
addaleax pushed a commit to ayojs/ayo that referenced this pull request Dec 7, 2017
@apapirovski @addaleax
http2: do not allow socket manipulation
2b12570 
Because of the specific serialization and processing requirements
of HTTP/2, sockets should not be directly manipulated. This
forbids any interactions with destroy, emit, end, pause, read,
resume and write methods of the socket. It also redirects
setTimeout to session instead of socket.

PR-URL: nodejs/node#16330
Fixes: nodejs/node#16252
Refs: nodejs/node#16211
Reviewed-By: James M Snell <jasnell@gmail.com>
addaleax pushed a commit to ayojs/ayo that referenced this pull request Dec 7, 2017
@gibfahn @addaleax
2017-10-31, Version 8.9.0 'Carbon' (LTS) Release
ceddd58 
This LTS release comes with 87 commits. This includes 30 that are
updates to lib/ or src/, 20 that are test related, 13 that are doc
related, 19 which are build / tools related, and 4 commits which are
updates to dependencies.

Notable Changes:

* doc:
  - add Gibson Fahnestock to Release team (Gibson Fahnestock)
    nodejs/node#16620
* deps:
  - update npm to 5.5.1 (Myles Borins)
    nodejs/node#16509
* http2:
  - The exposed http2 socket is no longer manipulatable
    (Anatoli Papirovski)
    nodejs/node#16330
* module:
  - support custom paths to require.resolve() (cjihrig)
    nodejs/node#16397
* util:
  - util.TextEncoder and util.TextDecoder are no longer experimental.
    There will no longer be a warning when they are used
    (James M Snell)
    nodejs/node#15743

PR-URL: nodejs/node#16630
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jasnell jasnell jasnell approved these changes

@mcollina mcollina Awaiting requested review from mcollina

Assignees
No one assigned
Labels
http2 Issues or PRs related to the http2 subsystem. lib / src Issues and PRs related to general changes in the lib or src directory.
Projects
None yet
Milestone
9.0.0
Development

Successfully merging this pull request may close these issues.
4 participants
@apapirovski @jasnell @MylesBorins @nodejs-github-bot