Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto: fix DiffieHellman generator validation #38311

Merged
merged 15 commits into from
Apr 23, 2021
Merged

crypto: fix DiffieHellman generator validation #38311

merged 15 commits into from
Apr 23, 2021

Conversation

EladKeyshawn
Copy link

@EladKeyshawn EladKeyshawn commented Apr 20, 2021 •
edited by aduh95
Loading

Fixes: #38302

@nodejs-github-bot nodejs-github-bot added crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels Apr 20, 2021
@EladKeyshawn EladKeyshawn force-pushed the eladkeyshawn/crypto.createDiffieHellman-abort branch from 23b458d to 9ded02e Compare April 20, 2021 12:32
@EladKeyshawn
Copy link
Author

I had a mistake at the actual problem I had to fix, fixing it now...

aduh95
aduh95 reviewed Apr 20, 2021
View reviewed changes
test/parallel/test-crypto-dh.js Outdated Show resolved Hide resolved
lib/internal/crypto/diffiehellman.js Outdated Show resolved Hide resolved
@aduh95 aduh95 changed the title crypto: add sizeOrKey validation at DiffieHellman constructor crypto: fix DiffieHellman generator validation Apr 20, 2021
@nodejs-github-bot
Copy link
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/37581/

@BethGriggs
2021-04-20, Version 16.0.0 (Current)
8780537 
Notable changes:

Deprecations and Removals:

- **(SEMVER-MAJOR)** **fs**: remove permissive rmdir recursive
  (Antoine du Hamel) [nodejs#37216]
- **(SEMVER-MAJOR)** **fs**: runtime deprecate rmdir recursive option
  (Antoine du Hamel) [nodejs#37302]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('http_parser') (James M Snell) [nodejs#37813]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('url') (James M Snell) [nodejs#37799]
- **(SEMVER-MAJOR)** **lib**: make process.binding('util') return only
  type checkers (Anna Henningsen) [nodejs#37819]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('crypto') (James M Snell) [nodejs#37790]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('signal_wrap') (James M Snell) [nodejs#37800]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('v8') (James M Snell) [nodejs#37789]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('async_wrap') (James M Snell) [nodejs#37576]
- **(SEMVER-MAJOR)** **module**: remove module.createRequireFromPath
  (Antoine du Hamel) [nodejs#37201]
- **(SEMVER-MAJOR)** **module**: runtime deprecate subpath folder
  mappings (Antoine du Hamel) [nodejs#37215]
- **(SEMVER-MAJOR)** **module**: runtime deprecate "main" index and
  extension lookups (Antoine du Hamel) [nodejs#37206]
- **(SEMVER-MAJOR)** **module**: runtime deprecate invalid package.json
  main entries (Antoine du Hamel) [nodejs#37204]
- **(SEMVER-MAJOR)** **process**: runtime deprecate changing
  process.config (James M Snell) [nodejs#36902]

Stable Timers Promises API:

The Timers Promises API provides an alternative set of timer functions
that return Promise objects. Added in Node.js v15.0.0, in this release
they graduate from experimental status to stable.

Contributed by James Snell - [nodejs#38112]

Toolchain and Compiler Upgrades:

Node.js v16.0.0 will be the first release where we ship prebuilt
binaries for Apple Silicon. While we’ll be providing separate tarballs
for the Intel (`darwin-x64`) and ARM (`darwin-arm64`) architectures the
macOS installer (`.pkg`) will be shipped as a ‘fat’ (multi-architecture)
binary.

- **(SEMVER-MAJOR)** **build**: remove support for Python 2 (Christian
  Clauss) [nodejs#36691]
- **(SEMVER-MAJOR)** **build**: default PYTHON to python3 in Makefile
  (Michaël Zasso) [nodejs#37764]
- **build**: update Makefile to support fat binary (Ash Cripps)
  [nodejs#37861]
- **(SEMVER-MAJOR)** **build**: enable ASLR (PIE) on OS X (woodfairy)
  [nodejs#35704]
- **build**: warn for gcc versions earlier than 8.3.0 (Richard Lau)
  [nodejs#37935]
- **(SEMVER-MAJOR)** **doc**: update minimum supported Xcode to 11
  (Michaël Zasso) [nodejs#37872]
- **(SEMVER-MAJOR)** **doc**: update minimum supported GCC to 8.3
  (Michaël Zasso) [nodejs#37871]
- **(SEMVER-MAJOR)** **doc**: update AIX to GCC8 for v16.x (Ash Cripps)
  [nodejs#37677]
- **tools**: set arch in Distribution.xml (Ash Cripps)
  [nodejs#38261]

V8 9.0:

The V8 JavaScript engine is updated to V8 9.0, including performance
tweaks and improvements.

This update also brings the ECMAScript RegExp Match Indices, which
provide the start and end indices of the captured string. The indices
array is available via the `.indices` property on match objects when the
regular expression has the `/d` flag.

Contributed by Michaël Zasso - [nodejs#37587]

Other Notable Changes:

- **(SEMVER-MINOR)** **assert**: graduate assert.match and
  assert.doesNotMatch (James M Snell) [nodejs#38111]
- **(SEMVER-MAJOR)** **buffer**: expose btoa and atob as globals
  (James M Snell) [nodejs#37786]
- **(SEMVER-MAJOR)** **deps**: bump minimum ICU version to 68
  (Michaël Zasso) [nodejs#37330]
- **deps**: update ICU to 69.1 (Michaël Zasso)
  [nodejs#38178]
- **deps**: update llhttp to 6.0.0 (Fedor Indutny)
  [nodejs#38277]
- **deps**: upgrade npm to 7.10.0 (Ruy Adorno)
  [nodejs#38254]
- **(SEMVER-MINOR)** **http**: add http.ClientRequest.getRawHeaderNames()
  (simov) [nodejs#37660]
- **(SEMVER-MAJOR)** **lib,src**: update cluster to use Parent
  (Michael Dawson) [nodejs#36478]
- **(SEMVER-MINOR)** **module**: add support for `node:`‑prefixed
  `require(…)` calls (ExE Boss) [nodejs#37246]
- **(SEMVER-MINOR)** **perf_hooks**: add histogram option to timerify
  (James M Snell) [nodejs#37475]
- **(SEMVER-MINOR)** **repl**: add auto‑completion for `node:`‑prefixed
  `require(…)` calls (ExE Boss) [nodejs#37246]
- **(SEMVER-MINOR)** **util**: add getSystemErrorMap() impl
  (eladkeyshawn) [nodejs#38101]

Semver-Major Commits:

- **(SEMVER-MAJOR)** **async_hooks**: add thisArg to AsyncResource.bind
  (James M Snell) [nodejs#36782]
- **(SEMVER-MAJOR)** **buffer**: expose btoa and atob as globals
  (James M Snell) [nodejs#37786]
- **(SEMVER-MAJOR)** **build**: remove support for Python 2
  (Christian Clauss) [nodejs#36691]
- **(SEMVER-MAJOR)** **build**: default PYTHON to python3 in Makefile
  (Michaël Zasso) [nodejs#37764]
- **(SEMVER-MAJOR)** **build**: update Makefile to support fat binary
  (Ash Cripps) [nodejs#37861]
- **(SEMVER-MAJOR)** **build**: include minimal V8 headers in
  distribution (Michaël Zasso) [nodejs#37570]
- **(SEMVER-MAJOR)** **build**: use C++11 ABI with libstdc++
  (Anna Henningsen) [nodejs#36634]
- **(SEMVER-MAJOR)** **build**: enable ASLR (PIE) on OS X (woodfairy)
  [nodejs#35704]
- **(SEMVER-MAJOR)** **deps**: update V8 to 9.0.257.11 (Michaël Zasso)
  [nodejs#37587]
- **(SEMVER-MAJOR)** **deps**: bump minimum ICU version to 68
  (Michaël Zasso) [nodejs#37330]
- **(SEMVER-MAJOR)** **deps**: update V8 to 8.9.255.19 (Michaël Zasso)
  [nodejs#37330]
- **(SEMVER-MAJOR)** **deps**: update V8 to 8.8.278.17 (Michaël Zasso)
  [nodejs#36139]
- **(SEMVER-MAJOR)** **deps**: update V8 to 8.7.220 (Michaël Zasso)
  [nodejs#35700]
- **(SEMVER-MAJOR)** **dns**: use url module instead of punycode for
  IDNA (Antoine du Hamel) [nodejs#35091]
- **(SEMVER-MAJOR)** **doc**: update minimum supported Xcode to 11
  (Michaël Zasso) [nodejs#37872]
- **(SEMVER-MAJOR)** **doc**: update minimum supported GCC to 8.3
  (Michaël Zasso) [nodejs#37871]
- **(SEMVER-MAJOR)** **doc**: update AIX to GCC8 for v16.x (Ash Cripps)
  [nodejs#37677]
- **(SEMVER-MAJOR)** **doc**: add http.IncomingMessage#connection
  (Pranshu Srivastava) [nodejs#33768]
- **(SEMVER-MAJOR)** **events**: change EventTarget handler exception
  behavior (Nitzan Uziely) [nodejs#37237]
- **(SEMVER-MAJOR)** **fs**: remove permissive rmdir recursive
  (Antoine du Hamel) [nodejs#37216]
- **(SEMVER-MAJOR)** **fs**: add validation for fd and path
  (Dylan Elliott) [nodejs#35187]
- **(SEMVER-MAJOR)** **fs**: runtime deprecate rmdir recursive option
  (Antoine du Hamel) [nodejs#37302]
- **(SEMVER-MAJOR)** **fs**: fix flag and mode validation
  (James M Snell) [nodejs#37480]
- **(SEMVER-MAJOR)** **http**: use objects with null prototype in Agent
  (Michaël Zasso) [nodejs#36409]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('http_parser') (James M Snell)
  [nodejs#37813]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('url') (James M Snell)
  [nodejs#37799]
- **(SEMVER-MAJOR)** **lib**: make process.binding('util') return only
  type checkers (Anna Henningsen) [nodejs#37819]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('crypto') (James M Snell) [nodejs#37790]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('signal_wrap') (James M Snell) [nodejs#37800]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('v8') (James M Snell) [nodejs#37789]
- **(SEMVER-MAJOR)** **lib**: aggregate errors to avoid error swallowing
  (Antoine du Hamel) [nodejs#37460]
- **(SEMVER-MAJOR)** **lib**: runtime deprecate access to
  process.binding('async_wrap') (James M Snell) [nodejs#37576]
- **(SEMVER-MAJOR)** **lib**: remove usage of url.parse
  (raisinten) [nodejs#36853]
- **(SEMVER-MAJOR)** **lib**: add error handling for input stream
  (rexagod) [nodejs#31603]
- **(SEMVER-MAJOR)** **lib,src**: update cluster to use Parent
  (Michael Dawson) [nodejs#36478]
- **(SEMVER-MAJOR)** **module**: runtime deprecate subpath folder
  mappings (Antoine du Hamel) [nodejs#37215]
- **(SEMVER-MAJOR)** **module**: runtime deprecate "main" index and
  extension lookups (Antoine du Hamel) [nodejs#37206]
- **(SEMVER-MAJOR)** **module**: runtime deprecate invalid package.json
  main entries (Antoine du Hamel) [nodejs#37204]
- **(SEMVER-MAJOR)** **module**: remove module.createRequireFromPath
  (Antoine du Hamel) [nodejs#37201]
- **(SEMVER-MAJOR)** **module**: only set cache when finding module
  succeeds (Yongsheng Zhang) [nodejs#36642]
- **(SEMVER-MAJOR)** **perf_hooks**: make performance a global (James M
  Snell) [nodejs#37970]
- **(SEMVER-MAJOR)** **perf_hooks**: complete overhaul of the
  implementation (James M Snell) [nodejs#37136]
- **(SEMVER-MAJOR)** **process**: disallow adding options to
  process.allowedNodeEnvironmentFlags (Antoine du Hamel)
  [nodejs#36660]
- **(SEMVER-MAJOR)** **process**: runtime deprecate changing
  process.config (James M Snell) [nodejs#36902]
- **(SEMVER-MAJOR)** **readline**: cursorTo throw error on NaN
  (Zijian Liu) [nodejs#36379]
- **(SEMVER-MAJOR)** **src**: mark internally exported functions as
  explicitly internal (Tyler Ang-Wanek) [nodejs#37000]
- **(SEMVER-MAJOR)** **src**: inline AsyncCleanupHookHandle in headers
  (Tyler Ang-Wanek) [nodejs#37000]
- **(SEMVER-MAJOR)** **src**: clean up embedder API (Anna Henningsen)
  [nodejs#35897]
- **(SEMVER-MAJOR)** **worker**: send correct error status for worker
  init (Yash Ladha) [nodejs#36242]

PR-URL: nodejs#37678
@aduh95 aduh95 added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Apr 20, 2021
@targos
deps: patch V8 to 9.0.257.19
053aa6d 
Refs: v8/v8@9.0.257.17...9.0.257.19

PR-URL: nodejs#38270
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
richardlau and others added 7 commits April 21, 2021 16:43
@richardlau
tools: fix type mismatch in test runner
e703ceb 
`output.diagnostic` is a list that is appended to on SmartOS when
retrying a test due to `ECONNREFUSED`. The test runner checks if
`output.diagnostic` is truthy and, if so, assigns its value to
`self.traceback`. However `self.traceback` is supposed to be a string,
and `_printDiagnostic()` in the `TapProgressIndicator` attempts to call
`splitlines()` on it, which fails if it is a list with:
AttributeError: 'list' object has no attribute 'splitlines'

PR-URL: nodejs#38289
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Christian Clauss <cclauss@me.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
@richardlau
test: use .test domain for not found address
8645a36 
While it is extremely unlikely that `.fhqwhgads` will become a valid
domain, we should, where possible, use one of the reserved domains for
testing.

Refs: https://tools.ietf.org/html/rfc2606

PR-URL: nodejs#38286
Refs: nodejs#38282
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
@VoltrexKeyva @aduh95
doc: use foo.prototype.bar notation in buffer.md
8cb6b5d 
Most of the documentation uses `foo.prototype.bar` notation instead of
`foo#bar` notation, this commit apply the former in `buffer.md`.

PR-URL: nodejs#38032
Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
@eladkishon @aduh95
tls: fix tlsSocket.setMaxSendFragment abort
6e3f985 
PR-URL: nodejs#38170
Fixes: nodejs#38169
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@aduh95
bootstrap: freeze more intrinsics
7264dbd 
PR-URL: nodejs#38217
Reviewed-By: Guy Bedford <guybedford@gmail.com>
@Linkgoron @aduh95
fs: allow no-params fsPromises fileHandle read
5370220 
allow no-params read for fsPromises fileHandle read

PR-URL: nodejs#38287
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
@andresatencio @aduh95
test: replace function with arrow function and remove unused argument
4243ce0 
PR-URL: nodejs#38235
Reviewed-By: Yash Ladha <yash@yashladha.in>
Reviewed-By: Pooja D P <Pooja.D.P@ibm.com>
Reviewed-By: Harshitha K P <harshitha014@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
addaleax and others added 6 commits April 22, 2021 16:39
@addaleax
repl: display prompt once after error callback
9f5977a 
Do not call `.displayPrompt()` twice after the `eval` callback
resulted in an error.

(This does not affect the default eval because it doesn’t use
the callback if an error occurs.)

PR-URL: nodejs#38314
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
@Trott
doc: update TSC members list with three new members
8ca373f 
PR-URL: nodejs#38352
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Nitzan Uziely <linkgoron@gmail.com>
@danbev
doc: add nodejs-sec email template
63bed54 
This commit adds a suggestion for a template to be used as part of the
security release process. One step of this process is to create an email
to nodejs-sec group and currently would contain a copy and pasted
version of what is published on nodejs.org. This suggestion is to
instead use a link to the blog post.

PR-URL: nodejs#38290
Refs: nodejs#38143
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@jaydenseric @aduh95
doc: fix YAML comment opening tags
37b811a 
Several YAML documentation comments incorrectly started with `<!--YAML`
instead of `<!-- YAML`, resulting in their content missing in the
rendered documentation.

PR-URL: nodejs#38324
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
@aduh95
tls: validate ticket keys buffer
e151e90 
Fixes: nodejs#38305

PR-URL: nodejs#38308
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@eladkishon @aduh95
crypto: fix DiffieHellman generator validation
88bc864 
PR-URL: nodejs#38311
Fixes: nodejs#38302
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
@aduh95
Copy link
Contributor

aduh95 commented Apr 23, 2021

Landed in 88bc864

@aduh95 aduh95 closed this Apr 23, 2021
@aduh95 aduh95 merged commit 88bc864 into nodejs:master Apr 23, 2021
targos pushed a commit that referenced this pull request Apr 29, 2021
@eladkishon @targos
crypto: fix DiffieHellman generator validation
7354479 
PR-URL: #38311
Fixes: #38302
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
@targos targos mentioned this pull request May 3, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jasnell jasnell jasnell approved these changes

@benjamingr benjamingr benjamingr approved these changes

@lpinca lpinca lpinca approved these changes

@JungMinu JungMinu JungMinu approved these changes

@aduh95 aduh95 aduh95 approved these changes

@RaisinTen RaisinTen RaisinTen approved these changes

Assignees
No one assigned
Labels
author ready PRs that have at least one approval, no pending requests for changes, and a CI started. crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

crypto.createDiffieHellman results in an abort