Commit Graph

199 Commits

Author SHA1 Message Date
Peter Korsgaard
a240f9da85 package/nodejs: security bump to version 16.20.0
Fixes the following security issues:

- CVE-2023-23918: Node.js Permissions policies can be bypassed via
  process.mainModule (High)

- CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto
  library (Medium)

- CVE-2023-23920: Node.js insecure loading of ICU data through ICU\_DATA
  environment variable (Low)

- CVE-2023-23936: Fetch API in Node.js did not protect against CRLF
  injection in host headers (Medium)
  https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff

- CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js
  fetch API (Low)
  https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w

For more details, see the advisory:
https://nodejs.org/en/blog/vulnerability/february-2023-security-releases

Update LICENSE hash after an update of the openssl license snippet:
e7ed56f501

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-06-19 21:36:41 +02:00
Thomas Claveirole
7c73f93218 package/nodejs: introduce BR2_PACKAGE_HOST_NODEJS_COREPACK
Corepack is a zero-runtime-dependency Node.js script that acts as a
bridge between Node.js projects and the package managers.  It ships
with Node.js but is disabled by default.

Some JavaScript packages, such as vuejs and vuejs-router can benefit
from having Corepack installed on the host.  Therefore, add an option
to enable Corepack with host-nodejs.

Signed-off-by: Thomas Claveirole <thomas.claveirole@green-communications.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-04-16 21:41:27 +02:00
Thomas Petazzoni
0de216f95f package/nodejs: add patch to adjust default NodeJS search path
By default, NodeJS searches global modules in /usr/lib/node, but NPM
installs them in /usr/lib/node_modules/. Therefore by default, if one
installs modules with BR2_PACKAGE_NODEJS_MODULES_ADDITIONAL, they are
not accessible by NodeJS, unless by passing a
NODE_PATH=/usr/lib/node_modules/ variable. Since this is not obvious,
and it's nicer when things work out of the box, we simply patch NodeJS
to look for modules at the right place.

See
https://stackoverflow.com/questions/15636367/nodejs-require-a-global-module-package
for some discussions on this topic.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-02-11 00:11:29 +01:00
Peter Korsgaard
58ba17c784 package/nodejs: security bump to version 16.18.1
Fixes the following security issue:

DNS rebinding in --inspect via invalid octal IP address (Medium) (CVE-2022-43548)

The Node.js rebinding protector for --inspect still allows invalid IP
address, specifically, the octal format.  An example of an octal IP address
is 1.09.0.0, the 09 octet is invalid because 9 is not a number in the base 8
number system.  Browsers such as Firefox (tested on latest version m105)
will still attempt to resolve this invalid octal address via DNS.  When
combined with an active --inspect session, such as when using VSCode, an
attacker can perform DNS rebinding and execute arbitrary code

Update license hash for an update of base64 (MIT license) and a change in
copyright year:

8ea9a71b15
9f14dc1a8f

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-11-20 10:01:14 +01:00
Thomas Petazzoni
69d311687a package/nodejs: drop support for the MIPS architecture
The build of NodeJS fails on mipsel due to an issue in the V8 code:

../../deps/v8/src/compiler/backend/mips/code-generator-mips.cc:4106:48: error: call of overloaded 'Operand(int64_t)' is ambiguous
 4106 |                 Operand(static_cast<int64_t>(0)));

There is apparently a lack of maintenance of the MIPS port of V8, as
is discussed in the Github issue at
https://github.com/nodejs/node/issues/26179.

Until this get improved/fixed, our best option is to drop support for
MIPS in our NodeJS package.

Fixes:

  http://autobuild.buildroot.net/results/0e6ee80c77bcb77afe18410e8d9da93b738cb0a4/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-10-30 12:10:39 +01:00
James Hilliard
f073cf7547 package/nodejs: bypass configure shell wrapper
The configure file is a shell script which searches for a predefined
python binary and then calls configure.py with that.

As we already call configure with the desired python binary we should
call configure.py directly so that the expected python binary is used
and so that the shell wrapper doesn't throw spurious interpreter
validation errors.

This also avoid spurious errors due to the configure shell wrapper
missing supported python versions, for example this fixes:
Node.js configure: Found Python 3.11.0...
Please use python3.10 or python3.9 or python3.8 or python3.7 or python3.6.
	/usr/bin/python3.10 ./configure

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-10-25 22:56:58 +02:00
Thomas Petazzoni
a8a65d0951 package/nodejs: bump to v16.17.1
This is currently the latest version in the v16.x branch.

Patch 0001-add-qemu-wrapper-support.patch needs some minor adaptations
to resolve conflicts with other unrelated upstream changes. The other
patches are simply refreshed.

The license file is updates due to:

 - Reformatting changes

 - Addition of the mention of some files being under GPLv3, but it's
   only the autoconf machinery: aclocal.m4 and config.guess, so it's
   not relevant to add in our LICENSE variable.

 - Addition of the mention of another file being under the MIT
   license (install-sh), and MIT is already listed, and this file is
   anyway only part of the autoconf machinery.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-09-25 19:37:55 +02:00
Thomas Petazzoni
a88ba1548a package/nodejs: fixup qemu dependencies
Commit 1facb09b94 ("package/nodejs:
build host-nodejs only if we're installing modules with NPM") forgot
to account for the dependency on Qemu. Now that nodejs no longer
depends on host-nodejs, but needs host-qemu, we need to make sure that
nodejs selects the relevant BR2_PACKAGE_HOST_QEMU options.

So this patch:

 - Drops the dependency of BR2_PACKAGE_NODEJS_ARCH_SUPPORTS on
   BR2_PACKAGE_QEMU_ARCH_SUPPORTS_TARGET, which was incorrect: we
   don't care about running Qemu on the target. We care about
   host-qemu supporting the emulation of the target architecture,
   which is what BR2_PACKAGE_HOST_QEMU_ARCH_SUPPORTS is for.

 - Adds the dependency to the relevant BR2_PACKAGE_HOST_QEMU options
   to BR2_PACKAGE_NODEJS, so that host-qemu is built with the
   appropriate features needed to build the target nodejs.

 - Removes the qemu related dependencies from host-nodejs, which does
   not need Qemu at all.

Without this change the build of nodejs without npm enabled is broken
as the host-qemu that gets built does not have all the features that
are needed. There are no autobuild failures at this point, however.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-09-25 19:36:49 +02:00
Alexandru Ardelean
1facb09b94 package/nodejs: build host-nodejs only if we're installing modules with NPM
Building host-nodejs is no longer needed to build the target nodejs,
unless npm is needed during the build, which happens when
BR2_PACKAGE_NODEJS_MODULES_ADDITIONAL is used.

We need to make that host-python3 is built with bz2 and ssl
support. Until now, it was done by the BR2_PACKAGE_HOST_NODEJS option,
but now that the target nodejs no longer depends on host-nodejs, we
are no longer guaranteed to have a host-python3 with bz2/ssl. To make
sure it is the case, we select the relevant options from
BR2_PACKAGE_NODEJS.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-09-25 10:19:49 +02:00
Alexandru Ardelean
ec5589611a package/nodejs: don't install nodejs host-tools
The target nodejs package is building those tools, and running them
under Qemu, so it is not necessary for the host variant to install
them.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-09-25 10:19:38 +02:00
Thomas Petazzoni
cf0ddc8970 package/nodejs: improve 0001-add-qemu-wrapper-support.patch to fix build issue
Since upstream commit 79da2534737bd090b7000beed68d225618606e53,
present since NodeJS 16.0.0, another call to the torque tool is done
in tools/v8_gypfiles/v8.gyp, but our patch to wrap calls to such tools
under Qemu forgot this addition. Due to this, the build of NodeJS is
broken since the bump to v16 in Buildroot commit
07408779cc ("package/nodejs: bump to
16.15.0"). This issue is not visible in the autobuilders as it was
hidden by a previous build issue, itself fixed by "package/nodejs: fix
'Duplicate v8 target errors when cross-compiling' error".

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-09-25 10:19:12 +02:00
Alexandru Ardelean
5708c5b04f package/nodejs: fix 'Duplicate v8 target errors when cross-compiling' error
Reported also via:
  https://github.com/nodejs/node/issues/37441

Patched in:
  5e533cb943

The error is:
```
ninja: Entering directory `out/Release'
ninja: error: obj.host/tools/v8_gypfiles/run_torque.ninja:1356: multiple rules generate gen/torque-generated/bit-fields.h [-w dupbuild=err]

make[2]: *** [Makefile:127: node] Error 1
make[1]: *** [package/pkg-generic.mk:293: <buildroot>/output/build/nodejs-16.15.0/.stamp_built] Error 2
make: *** [Makefile:84: _all] Error 2

```

Fixes:

  http://autobuild.buildroot.net/results/7fe9132236ee8e3a86dd97fe96ffee42990c2d19/

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
[Thomas:
 - regenerate patch as a git formatted patch, add a link to the
   original location, add my own SoB to it
 - improve commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-09-25 10:18:48 +02:00
Thomas Petazzoni
f85e2cfc6e package/nodejs: renumber patch 0001 to 0002
There is already another 0001 patch.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-09-25 10:18:48 +02:00
Fabrice Fontaine
d7d6fda52f package/nodejs: security bump to version 16.16.0
Fix CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-32212,
CVE-2022-32223, CVE-2022-32222 and CVE-2022-2097

https://nodejs.org/en/blog/vulnerability/july-2022-security-releases
https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V16.md#16.16.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2022-07-24 14:22:09 +02:00
Fabrice Fontaine
33e947a2d5 package/nodejs: fix legal info
Commit 07408779cc forgot to update hash of
LICENSE file (multiple components under MIT added:
71659fd4ba
f17ce913c9)

ERROR: LICENSE has wrong sha256 hash:
ERROR: expected: b3a67885b5a6ac35e8bbe8190509e41b79b0d9a2e3fbd47186f2ac4727f63be5
ERROR: got     : 6211cc77f9ceaf365db12faf050775b3a1e6da7a1eff3577ba006c4918103c33

Fixes:
 - http://autobuild.buildroot.org/results/bd1e3238f294152d54ee8f5579431606309dbff3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-05-14 22:39:29 +02:00
Arnout Vandecappelle (Essensium/Mind)
fa56c5f4a2 package/nodejs: use ninja for build
Not only is ninja much faster, it also avoids the following build
failure:
make[3]: printf: Argument list too long

This failure happens when the output directory is about 6 levels deep.
It's due to the make generator of gyp that uses some crazy shell
processing for splitting up paths on /. The ninja generator does no such
thing.

While we're at it, remove redundant parenthesis in
HOST_NODEJS_CONFIGURE_CMDS.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-05-12 22:16:17 +02:00
Arnout Vandecappelle (Essensium/Mind)
fb5aad3024 package/nodejs: clean up DEPENDENCIES
One per line, and alphabetical (was already the case for host).

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
[yann.morin.1998@free.fr: all host dependencies first]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-05-12 22:15:12 +02:00
Kyle Discher
07408779cc package/nodejs: bump to 16.15.0
Signed-off-by: Kyle Discher <discher.kyle@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-05-12 22:14:18 +02:00
James Hilliard
bcaf5eb0c1 package/nodejs: add missing host-pkgconf dependency
Fixes:
 - http://autobuild.buildroot.net/results/d1f/d1f49b451b56e3cf6a97d27e8db5b85b0cb58ca9

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2022-04-27 21:27:09 +02:00
James Hilliard
f93039e3a6 package/icu: don't disable renaming for host build
Using a different renaming option for the icu host build can cause
issues for packages such as qt5webengine which expect target and
host packages to be built with the same options.

A package that needs both host and target to have the same options is most
probably doing somethig wrong, like linking a host program and taking the
result as valid for the target.

However, our adding the --disable-renaming in the first place in 3911e67151
(icu: security bump to version 51.2) did not provide any explanations why it
was needed to begin with, so drop it.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Yann E. MORIN <yann.morin.1998@free.fr>
[Peter: extend commit message as suggested by Yann]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-13 17:57:44 +01:00
Peter Korsgaard
9096036f00 package/nodejs: security bump to version 14.18.3
Fixes the following security issues:

Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is
specifically defined to use a particular SAN type, can result in bypassing
name-constrained intermediates.  Node.js was accepting URI SAN types, which
PKIs are often not defined to use.  Additionally, when a protocol allows URI
SANs, Node.js did not match the URI correctly.

Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)

Node.js converts SANs (Subject Alternative Names) to a string format.  It
uses this string to check peer certificates against hostnames when
validating connections.  The string format was subject to an injection
vulnerability when name constraints were used within a certificate chain,
allowing the bypass of these name constraints.

Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)

Node.js did not handle multi-value Relative Distinguished Names correctly.
Attackers could craft certificate subjects containing a single-value
Relative Distinguished Name that would be interpreted as a multi-value
Relative Distinguished Name, for example, in order to inject a Common Name
that would allow bypassing the certificate subject verification.

Prototype pollution via console.table properties (Low)(CVE-2022-21824)

Due to the formatting logic of the console.table() function it was not safe
to allow user controlled input to be passed to the properties parameter
while simultaneously passing a plain object with at least one property as
the first parameter, which could be __proto__.  The prototype pollution has
very limited control, in that it only allows an empty string to be assigned
numerical keys of the object prototype.

For details, see the advisory:
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-17 22:34:41 +01:00
Fabrice Fontaine
e1bbe25437 package/nodejs: fix host dependencies
Fix the following build failure raised since commit
78d7c5f803:

WARNING: unmet direct dependencies detected for BR2_PACKAGE_HOST_QEMU
  Depends on [n]: (BR2_PACKAGE_HOST_QEMU_SYSTEM_ARCH_SUPPORTS [=n] || BR2_PACKAGE_HOST_QEMU_USER_ARCH_SUPPORTS [=n]) && BR2_HOST_GCC_AT_LEAST_8 [=y]
  Selected by [y]:
  - BR2_PACKAGE_HOST_NODEJS [=y] && BR2_HOST_GCC_AT_LEAST_7 [=y]

WARNING: unmet direct dependencies detected for BR2_PACKAGE_HOST_QEMU_LINUX_USER_MODE
  Depends on [n]: BR2_PACKAGE_HOST_QEMU [=y] && BR2_PACKAGE_HOST_QEMU_USER_ARCH_SUPPORTS [=n]
  Selected by [y]:
  - BR2_PACKAGE_HOST_NODEJS [=y] && BR2_HOST_GCC_AT_LEAST_7 [=y]

WARNING: unmet direct dependencies detected for BR2_PACKAGE_HOST_QEMU
  Depends on [n]: (BR2_PACKAGE_HOST_QEMU_SYSTEM_ARCH_SUPPORTS [=n] || BR2_PACKAGE_HOST_QEMU_USER_ARCH_SUPPORTS [=n]) && BR2_HOST_GCC_AT_LEAST_8 [=y]
  Selected by [y]:
  - BR2_PACKAGE_HOST_NODEJS [=y] && BR2_HOST_GCC_AT_LEAST_7 [=y]

WARNING: unmet direct dependencies detected for BR2_PACKAGE_HOST_QEMU_LINUX_USER_MODE
  Depends on [n]: BR2_PACKAGE_HOST_QEMU [=y] && BR2_PACKAGE_HOST_QEMU_USER_ARCH_SUPPORTS [=n]
  Selected by [y]:
  - BR2_PACKAGE_HOST_NODEJS [=y] && BR2_HOST_GCC_AT_LEAST_7 [=y]

Fixes:
 - http://autobuild.buildroot.org/results/d78f660ca4a609a0a072b3f2e04d456bf8cf663f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-12 07:47:50 +01:00
Fabrice Fontaine
5ad7eb6c61 package/nodejs: force host-python3
Build of nodejs fails if python 3.10 is installed on host.
As suggested by Arnout in
https://bugs.buildroot.org/show_bug.cgi?id=14451, use the same
workaround than in qt5webkit to force host-python3 (which is in version
3.9)

It should be noted that python 3.10 support has been added in version
14.18.2: https://github.com/nodejs/node/releases/tag/v14.18.2

Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=14451

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-09 17:24:08 +01:00
Fabrice Fontaine
06735b085f package/nodejs: bump to version 14.18.2
This bump will fix the following build failure raised since bump of
python3 to version 3.10.1 in commit
25b1fc2898:

Please use python3.9 or python3.8 or python3.7 or python3.6 or python3.5 or python2.7.
	/usr/bin/python3.7 ./configure
	/usr/bin/python3.5 ./configure
	/home/peko/autobuild/instance-1/output-1/host/bin/python2.7 ./configure
Node.js configure: Found Python 3.10.1...

https://github.com/nodejs/node/releases/tag/v14.18.2

Fixes:
 - http://autobuild.buildroot.org/results/9e2ebb9c3681ec0485eaa042fa838c8ee62f649b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Tested-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-01 11:26:49 +01:00
Linus Kaschulla
78d7c5f803 package/nodejs: add visible option to build host-nodejs
To use nodejs on the host (independant of the actual system) to create
some static files to place onto the target rootfs nodejs can be very
helpful.

The provided nodejs package didn't expose the possibility to create a
host package, which this commit adds.

This patch contains fixes based on feedback from:
- Peter Seiderer <ps.report@gmx.net>
- Yann E. MORIN <yann.morin.1998@free.fr>

Signed-off-by: Linus Kaschulla <linus@cosmos-ink.net>
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-12-28 23:05:25 +01:00
Adam Duskett
255acdc143 package/qemu: needs gcc >= 8
qemu now requires gcc >= 7.5, which was the last release in the 7.x
series. We do not have symbols for a gcc dot-version dependency, nor do
we want to add one.

So, add a dependency on gcc >= 8, for both the host and target variants.

In addition:
  - Add a missing comment in package/qemu/Config.in.host explaining the
    host gcc requirements if host gcc < 8.

Fixes:
    http://autobuild.buildroot.org/results/32b7fee1f8cda2290fd4bd8ac9fe78bacb25b652

Signed-off-by: Adam Duskett <aduskett@gmail.com>
[yann.morin.1998@free.fr:
  - target qemu also impacted
  - propagate to libvirt, gst1-python
  - reword commit log that 7.5 is the last 7.x release
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-10-25 23:01:20 +02:00
Adam Duskett
7cdfec3f77 package/nodejs: bump to version 14.18.1
Update license hash due to updating Acorn to v8.4.1

Signed-off-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-10-24 15:09:05 +02:00
Adam Duskett
779767d947 package/nodejs: bump version to 14.17.6
Changes include:
  - Remove the dependency on Python2, as nodejs 14 supports Python 3.
  - Remove --without-snapshot as it's no longer a supported config
    option.
  - Remove /openssl to the shared-openssl-includes config option, as the
    build system automatically appends /openssl to the includes path.

  - License file changes:
    - Removed deps/http_parser (MIT)
    - Removed deps/node-inspect (MIT)
    - Updated some URLs and license years
    Since the removed parts are MIT like NodeJS itself, the license info
    doesn't change.

  - Add a qemu wrapper. V8's JIT infrastructure requires binaries such
    as mksnapshot and mkpeephole to be run in the host during the build.
    However, these binaries must have the same bit-width as the target
    (e.g. a x86_64 host targeting ARMv6 needs to produce a 32-bit
    binary).  To work around this issue, cross-compile the binaries for
    the target and run them on the host with QEMU, much like
    gobject-introspection.

Signed-off-by: Adam Duskett <aduskett@gmail.com>
[Arnout:
 - use exec in qemu-wrapper script;
 - remove s390x support - qemu doesn't have it.
]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-10-21 21:43:29 +02:00
Peter Korsgaard
e3bdcdd596 package/nodejs: security bump to version 12.22.6
Fixes the following security issues:

- CVE-2021-37701: Arbitrary File Creation/Overwrite via insufficient symlink
  protection due to directory cache poisoning using symbolic links

- CVE-2021-37712: Arbitrary File Creation/Overwrite via insufficient symlink
  protection due to directory cache poisoning using symbolic links

- CVE-2021-37713: Arbitrary File Creation/Overwrite on Windows via
  insufficient relative path sanitization

- CVE-2021-39134: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

- CVE-2021-39135: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

For more details, see the advisory:
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-09-18 19:42:46 +02:00
Fabrice Fontaine
7038b029d8 package/nodejs: security bump to version 12.22.5
Fix CVE-2021-22931, CVE-2021-22940 and CVE-2021-22939:
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-08-27 21:49:56 +02:00
Peter Korsgaard
ca92d31cff package/nodejs: security bump to version 12.22.4
Fixes the following security issues:

- CVE-2021-22930: Use after free on close http2 on stream canceling (High)

  Node.js is vulnerable to a use after free attack where an attacker might
  be able to exploit the memory corruption, to change process behavior.

Drop 0002-Fix-build-with-ICU-68.patch as this is now fixed upstream since
https://github.com/nodejs/node/commit/e459c79b02

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-08-08 21:34:42 +02:00
James Hilliard
e5db5a472e package/nodejs: bump to version 12.22.3
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-07-19 23:03:12 +02:00
James Hilliard
6507ac846c package/nodejs: fix build with ICU 69
Fixes:
../deps/v8/src/objects/js-list-format.cc: In static member function ‘static v8::internal::MaybeHandle<v8::internal::JSListFormat> v8::internal::JSListFormat::New(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Map>, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>)’:
../deps/v8/src/objects/js-list-format.cc:173:67: error: ‘static icu::ListFormatter* icu::ListFormatter::createInstance(const icu::Locale&, const char*, UErrorCode&)’ is private within this context
  173 |       icu_locale, GetIcuStyleString(style_enum, type_enum), status);
      |                                                                   ^
In file included from ../deps/v8/src/objects/js-list-format.cc:25:
/home/buildroot/buildroot/output/per-package/host-icu/host/include/unicode/listformatter.h:267:27: note: declared private here
  267 |     static ListFormatter* createInstance(const Locale& locale, const char* style, UErrorCode& errorCode);
      |                           ^~~~~~~~~~~~~~

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-07-19 23:03:09 +02:00
Peter Korsgaard
0918d2bf2d package/nodejs: security bump to version 12.22.1
Fixes the following security issues:

CVE-2020-7774: npm upgrade to 6.14.12 - Update y18n to fix
Prototype-Pollution (High)

This is a vulnerability in the y18n npm module which may be exploited by
prototype pollution.

https://github.com/advisories/GHSA-c4w7-xm78-47vh

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-04-07 11:21:12 +02:00
Peter Korsgaard
7cb44a2011 package/nodejs: security bump to version v12.21.0
Fixes the following security issues:

CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion

Affected Node.js versions are vulnerable to denial of service attacks when
too many connection attempts with an 'unknownProtocol' are established.
This leads to a leak of file descriptors.  If a file descriptor limit is
configured on the system, then the server is unable to accept new
connections and prevent the process also from opening, e.g.  a file.  If no
file descriptor limit is configured, then this lead to an excessive memory
usage and cause the system to run out of memory.

CVE-2021-22884: DNS rebinding in --inspect

Affected Node.js versions are vulnerable to denial of service attacks when
the whitelist includes “localhost6”.  When “localhost6” is not present in
/etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e.,
over network.  If the attacker controls the victim's DNS server or can spoof
its responses, the DNS rebinding protection can be bypassed by using the
“localhost6” domain.  As long as the attacker uses the “localhost6” domain,
they can still apply the attack described in CVE-2018-7160.

For more details, see the advisory:
https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-25 21:29:29 +01:00
Fabrice Fontaine
1338f9c49b package/nodejs: add CPE variables
cpe:2.3🅰️nodejs:node.js is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Anodejs%3Anode.js

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-02-06 14:51:28 +01:00
Peter Korsgaard
ecc8f0fe84 package/nodejs: security bump to version 12.20.1
Fixes the following security issues:

- CVE-2020-8265: use-after-free in TLSWrap (High) Affected Node.js versions
  are vulnerable to a use-after-free bug in its TLS implementation.  When
  writing to a TLS enabled socket, node::StreamBase::Write calls
  node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first
  argument.  If the DoWrite method does not return an error, this object is
  passed back to the caller as part of a StreamWriteResult structure.  This
  may be exploited to corrupt memory leading to a Denial of Service or
  potentially other exploits

- CVE-2020-8287: HTTP Request Smuggling in nodejs Affected versions of
  Node.js allow two copies of a header field in a http request.  For
  example, two Transfer-Encoding header fields.  In this case Node.js
  identifies the first header field and ignores the second.  This can lead
  to HTTP Request Smuggling

- CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High)
  This is a vulnerability in OpenSSL which may be exploited through Node.js.
  You can read more about it in
  https://www.openssl.org/news/secadv/20201208.txt

Update the license hash for the addition of the (MIT licensed)
cjs-module-lexer module:
9eb1fa1924

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-01-09 23:53:36 +01:00
Peter Korsgaard
f359580796 package/nodejs: security bump to version 12.19.1
Fixes the following security issue:

- CVE-2020-8277: Denial of Service through DNS request (High).  A Node.js
  application that allows an attacker to trigger a DNS request for a host of
  their choice could trigger a Denial of Service by getting the application
  to resolve a DNS record with a larger number of responses.

https://nodejs.org/en/blog/release/v12.19.1/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-12-23 10:10:40 +01:00
Peter Korsgaard
b6d64d7fa4 package/nodejs: security bump to version 12.18.4
Fixes the following security issues:

- CVE-2020-8201: HTTP Request Smuggling due to CR-to-Hyphen conversion

  Affected Node.js versions converted carriage returns in HTTP request
  headers to a hyphen before parsing.  This can lead to HTTP Request
  Smuggling as it is a non-standard interpretation of the header.

  Impacts:
    All versions of the 14.x and 12.x releases line

- CVE-2020-8252: fs.realpath.native may cause buffer overflow

  libuv's realpath implementation incorrectly determined the buffer size
  which can result in a buffer overflow if the resolved path is longer than
  256 bytes.

  Impacts:
    All versions of the 10.x release line
    All versions of the 12.x release line

For more details, see the advisory:
https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/

Adjust license hash for the addition of the BSD-3c licensed highlight.js:
6f8b7a85d2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-10-01 21:22:35 +02:00
James Hilliard
319f7b0dab package/nodejs: use system-icu for host-nodejs
The nodejs configure.py file orders zlib headers before the bundled ICU
headers. The zlib headers happen to be located in the system include
directory, next to some system ICU headers (not bundled). If these are
built before nodejs is, nodejs will get confused and try to use the
system ICU headers instead of the bundled ones.

Fix this by always using host-icu.

Set CXXFLAGS to -DU_DISABLE_RENAMING=1 when building with
system-icu since host-icu is built with --disable-renaming.

Fixes:
 - http://autobuild.buildroot.net/results/1ef947553ec762dba6a6202b1cfc84ceed75dbb2/

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[yann.morin.1998@free.fr:
  - keep alphabetical order in _DEPENDENCIES
  - don't introduce HOST_NODEJS_CONF_OPTS
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-07-27 14:24:39 +02:00
Yegor Yefremov
f6e6e648ce package/nodejs: install to staging
Install header files and libraries into the staging area. Some
packages like mraa (if enabled for Node.js) search for node.h
and v8.h. Hence, Node.js development file must be installed to
the staging area.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-06-10 23:22:55 +02:00
Martin Bark
06decad41b package/nodejs: security bump to 12.18.0
This is a security release.

Vulnerabilities fixed:

CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High).
CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low).
CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).

See https://nodejs.org/en/blog/release/v12.18.0/

Signed-off-by: Martin Bark <martin@barkynet.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-06-03 23:00:32 +02:00
James Hilliard
b90ab938b8 package/nodejs: bump to version 12.16.3
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-05-09 14:31:10 +02:00
Adam Duskett
47b348114d package/nodejs: bump version to v12.16.1
Fixes a number of regressions introduced in v12.16.0:
https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V12.md#12.16.1

Tested on Debian 9 and Ubuntu 18.04

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-03-05 18:04:20 +01:00
Peter Korsgaard
61810db518 package/nodejs: security bump to version 12.16.0
Fixes the following security issues (12.15.0):

- CVE-2019-15606: HTTP header values do not have trailing OWS trimmed

- CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding
  header

- CVE-2019-15604: Remotely trigger an assertion on a TLS server with a
  malformed certificate string

For more details, see the advisory:
https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/

On top of this, 12.16.0 brings a number of changes and bugfixes.

Update the license hash for an addition of the (MIT) licensing terms for the
uvwsai module:

+
+- uvwasi, located at deps/uvwasi, is licensed as follows:
+  """
+    MIT License
+
+    Copyright (c) 2019 Colin Ihrig and Contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+  """

While we are at it, adjust the white space in the .hash function to match
the new agreements.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-02-18 03:51:37 +01:00
James Hilliard
ae1efb62e7 package/nodejs: bump to version 12.14.1
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-01-21 21:03:08 +01:00
Peter Korsgaard
65b89f393d package/nodejs: security bump to version 12.14.0
Fixes the following security vulnerabilities (in npm):

- CVE-2019-16775: Versions of the npm CLI prior to 6.13.3 are vulnerable to
  an Arbitrary File Write.  It is possible for packages to create symlinks
  to files outside of thenode_modules folder through the bin field upon
  installation
  https://www.npmjs.com/advisories/1436

- CVE-2019-16776: Versions of the npm CLI prior to 6.13.3 are vulnerable to
  an Arbitrary File Write.  It fails to prevent access to folders outside of
  the intended node_modules folder through the bin field
  https://www.npmjs.com/advisories/1434

- CVE-2019-16777: Versions of the npm CLI prior to 6.13.4 are vulnerable to
  an Arbitrary File Overwrite.  It fails to prevent existing
  globally-installed binaries to be overwritten by other package
  installations
  https://www.npmjs.com/advisories/1437

For further details, see the upstream announcements:

https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-12-19 14:44:08 +01:00
Thomas Petazzoni
f4abcbe112 package/nodejs: properly pass HOST_LDFLAGS when building host tools
After building host tools, we currently run a pass of patchelf to add
the proper RPATH to these tools so that they are able to find the
libraries they depend on.

Unfortunately, the "torque" host tool is used during the build itself,
before we have a chance to run "patchelf" on it. Since it is linked
against libcrypto.so available in $(HOST_DIR)/lib, the build aborts
because the RPATH is not set.

To fix this, we make sure that $(HOST_LDFLAGS) are properly taken into
account: since they contain the -Wl,-rpath option, the host tools will
have the correct RPATH. This both fixes the build failure, and makes
the patchelf hack no longer necessary.

Fixes:

  https://bugs.busybox.net/show_bug.cgi?id=12211
  http://autobuild.buildroot.net/results/a1f5e336ddaf386ba08eb5a7a299a48e2bdfe2d9/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-11-28 16:58:27 +01:00
Thomas Petazzoni
f3c80d711c package/nodejs: use --with-arm-fpu option on ARM
nodejs can use some FPU instructions on ARM, but it needs to know that
thanks to the --with-arm-fpu option. Without this, it may use the
wrong FPU setting, such as use VFPv3 even if only a VFPv3-D16 is
available. This has been reported as bug #12166, where the compiled
node binary had some floating point instructions using floating point
registers above 16 on a VFPv3-D16 system.

This commit makes sure we pass the appropriate --with-arm-fpu value
when it makes sense. Note that NodeJS only has explicit support for a
subset of the FPUs, for the ones that are not explicitly supported, we
simply pass no --with-arm-fpu value.

Fixes:

  https://bugs.busybox.net/show_bug.cgi?id=12166

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-11-28 16:56:26 +01:00
Thomas Petazzoni
78c8d6902d package/nodejs: properly pass the --with-arm-float-abi on ARM
When commit 0064132ba0 introduced ARM64
support in nodejs.mk, it incorrectly kept the NODEJS_ARM_FP
definition. This variable is used to pass --with-arm-float-abi, which
in NodeJS's configure.py script is only used when --dest-cpu=arm, and
not when --dest-cpu=arm64.

So we are passing --with-arm-float-abi=<something> for ARM64, which
has no effect, and we are no longer passing it on ARM.

This commit fixes that by putting the NODEJS_ARM_FP definition back at
the right location.

Fixes:

   0064132ba0

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-11-28 16:53:47 +01:00