Matteo Collina 53a6e4eb20 url: avoid hostname spoofing w/ javascript protocol ...

CVE-2018-12123

Fixes: https://github.com/nodejs-private/security/issues/205
PR-URL: https://github.com/nodejs-private/node-private/pull/145
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

2018-11-27 15:07:09 +11:00

..

internal

http,https: protect against slow headers attack

2018-11-27 15:07:09 +11:00

_http_agent.js

async_hooks: add missing async_hooks destroys in AsyncReset

2018-11-04 12:35:10 +00:00

_http_client.js

async_hooks: add missing async_hooks destroys in AsyncReset

2018-11-04 12:35:10 +00:00

_http_common.js

async_hooks: add missing async_hooks destroys in AsyncReset

2018-11-04 12:35:10 +00:00

_http_incoming.js

http: added aborted property to request

2018-10-17 00:07:24 +01:00

_http_outgoing.js

http: remove duplicate export

2018-01-24 01:18:15 -08:00

_http_server.js

http,https: protect against slow headers attack

2018-11-27 15:07:09 +11:00

_stream_duplex.js

stream: remove usage of *State.highWaterMark

2018-01-15 18:05:28 -05:00

_stream_passthrough.js

…

_stream_readable.js

stream: cleanup() when unpiping all streams.

2018-04-13 04:03:38 +01:00

_stream_transform.js

…

_stream_wrap.js

lib: move _stream_wrap into internals

2017-10-31 00:15:16 +00:00

_stream_writable.js

stream: delete redundant code

2018-08-16 11:38:49 +10:00

_tls_common.js

lib: use destructuring for some constants

2017-10-31 00:15:14 +00:00

_tls_legacy.js

tls: use correct class name in deprecation message

2018-08-16 11:38:48 +10:00

_tls_wrap.js

tls: expose Finished messages in TLSSocket

2018-08-16 01:59:10 -04:00

.eslintrc.yaml

test,benchmark,doc: enable dot-notation rule

2018-08-16 01:59:08 -04:00

assert.js

assert: ensure .rejects() disallows sync throws

2018-11-04 12:31:09 +00:00

async_hooks.js

src: fix error message in async_hooks constructor

2018-09-06 09:40:49 -07:00

buffer.js

buffer: fix typo in lib/buffer.js

2018-08-17 15:22:59 -04:00

child_process.js

util: implement util.getSystemErrorName()

2018-08-16 11:38:47 +10:00

cluster.js

…

console.js

tools: non-Ascii linter for /lib only

2018-04-10 16:30:50 +01:00

constants.js

…

crypto.js

crypto: make createXYZ inlineable

2017-12-20 01:58:39 +00:00

dgram.js

errors: move error creation helpers to errors.js

2018-08-16 11:38:48 +10:00

dns.js

errors: move error creation helpers to errors.js

2018-08-16 11:38:48 +10:00

domain.js

lib: use destructuring for some constants

2017-10-31 00:15:14 +00:00

events.js

…

fs.js

fs,net: emit 'ready' for fs streams and sockets

2018-08-16 01:59:11 -04:00

http2.js

http2: graduate from experimental

2018-10-17 00:07:24 +01:00

http.js

lib: use destructuring for some constants

2017-10-31 00:15:14 +00:00

https.js

http,https: protect against slow headers attack

2018-11-27 15:07:09 +11:00

inspector.js

lib: enable dot-notation eslint rule

2018-02-26 23:51:04 -05:00

module.js

module: Set dynamic import callback

2018-08-16 11:38:48 +10:00

net.js

process: use more direct sync I/O for stdio

2018-08-17 14:57:32 -04:00

os.js

lib: use destructuring for some constants

2017-10-31 00:15:14 +00:00

path.js

path: fix path.normalize for relative paths

2018-02-27 00:25:08 -05:00

perf_hooks.js

perf_hooks: fix timing

2018-09-06 09:40:51 -07:00

process.js

…

punycode.js

…

querystring.js

…

readline.js

readline: use Date.now() and move test to parallel

2018-04-13 03:53:52 +01:00

repl.js

repl: better handling of recoverable errors

2018-09-06 09:40:53 -07:00

stream.js

tools: non-Ascii linter for /lib only

2018-04-10 16:30:50 +01:00

string_decoder.js

string_decoder: reset decoder on end

2018-03-29 23:28:19 -04:00

sys.js

…

timers.js

timers: fix a bug in error handling

2018-05-15 14:01:37 -04:00

tls.js

http, tls: better support for IPv6 addresses

2018-01-26 17:54:41 +00:00

tty.js

tty: fix console printing on Windows

2018-08-17 15:16:53 -04:00

url.js

url: avoid hostname spoofing w/ javascript protocol

2018-11-27 15:07:09 +11:00

util.js

errors: move error creation helpers to errors.js

2018-08-16 11:38:48 +10:00

v8.js

v8: add new to the throw statement

2018-09-06 09:40:48 -07:00

vm.js

…

zlib.js

tools: non-Ascii linter for /lib only

2018-04-10 16:30:50 +01:00