Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump ws from 7.3.1 to 7.4.6 in /demo #1

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github May 31, 2021

Bumps ws from 7.3.1 to 7.4.6.

Release notes

Sourced from ws's releases.

7.4.6

Bug fixes

  • Fixed a ReDoS vulnerability (00c425ec).

A specially crafted value of the Sec-Websocket-Protocol header could be used to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

7.4.5

Bug fixes

  • UTF-8 validation is now done even if utf-8-validate is not installed (23ba6b29).
  • Fixed an edge case where websocket.close() and websocket.terminate() did not close the connection (67e25ff5).

7.4.4

Bug fixes

  • Fixed a bug that could cause the process to crash when using the permessage-deflate extension (92774377).

7.4.3

Bug fixes

  • The deflate/inflate stream is now reset instead of reinitialized when context takeover is disabled (#1840).

7.4.2

Bug fixes

... (truncated)

Commits
  • f5297f7 [dist] 7.4.6
  • 00c425e [security] Fix ReDoS vulnerability
  • 990306d [lint] Fix prettier error
  • 32e3a84 [security] Remove reference to Node Security Project
  • 8c914d1 [minor] Fix nits
  • fc7e27d [ci] Test on node 16
  • 587c201 [ci] Do not test on node 15
  • f672710 [dist] 7.4.5
  • 67e25ff [fix] Fix case where abortHandshake() does not close the connection
  • 23ba6b2 [fix] Make UTF-8 validation work even if utf-8-validate is not installed
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label May 31, 2021
vegerot pushed a commit that referenced this pull request Nov 11, 2021
exit_on_read_file_error_handlers has three concerns:

1. generate the error message
2. print the error message
3. exit the program with a failure

I want to reuse concern #1 without #2 or #3. Factor #1 into its own
function, make_read_file_error_handlers.

This commit should not change behavior.
vegerot pushed a commit that referenced this pull request Nov 11, 2021
DocumentLinter has two responsibilities:

1. sync text changes to the DocumentForVSCode
2. propagate diagnostics from the synced document

Config files need #1, but will have a different way of dealing with #2.
Separate these responsibilities into two classes: AbstractSyncedDocument
(for #1) and DocumentLinter (for #2).

This commit should not change behavior.
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Nov 11, 2021

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot rebase.

vegerot pushed a commit that referenced this pull request Jan 13, 2023
Tests are flaky on Windows [1]. Here's what I see on CI when a failure happens:

    [snip]
    1: [----------] 5 tests from typescript/test_parse_conditional_expression (0 ms total)
    1:
    1: [----------] Global test environment tear-down
    1: [==========] 1879 tests from 145 test suites ran. (9726 ms total)
    1: [  PASSED  ] 1879 tests.
    1:
    1:   YOU HAVE 1 DISABLED TEST
    1:
    1: D:/a/quick-lint-js/quick-lint-js/src/quick-lint-js/io/output-stream.cpp:101: internal check failed in flush_impl: false
    1: quick-lint-js crashed. Please report this bug here:
    1: https://quick-lint-js.com/crash-report/
    1/2 Test #1: quick-lint-js-test ...............***Failed    9.77 sec

Add some debug logs to help isolate the bug.

[1] quick-lint#859
vegerot pushed a commit that referenced this pull request Jan 13, 2023
test_debug_server.trace_websocket_sends_trace_data is failing
occasionally with the following message:

    [ RUN      ] test_debug_server.trace_websocket_sends_trace_data
    .../test/test-debug-server.cpp:464: Failure
    Actual function call count doesn't match EXPECT_CALL(v, visit_init_event(::testing::Field( &trace_stream_event_visitor::init_event::version, ::testing::StrEq("2.10.0"))))...
             Expected: to be called once
               Actual: never called - unsatisfied and active
    .../test/test-debug-server.cpp:461: Failure
    Actual function call count doesn't match EXPECT_CALL(v, visit_packet_header(::testing::_))...
             Expected: to be called once
               Actual: never called - unsatisfied and active
    .../test/test-debug-server.cpp:464: Failure
    Actual function call count doesn't match EXPECT_CALL(v, visit_init_event(::testing::Field( &trace_stream_event_visitor::init_event::version, ::testing::StrEq("2.10.0"))))...
             Expected: to be called once
               Actual: never called - unsatisfied and active
    .../test/test-debug-server.cpp:461: Failure
    Actual function call count doesn't match EXPECT_CALL(v, visit_packet_header(::testing::_))...
             Expected: to be called once
               Actual: never called - unsatisfied and active
    .../test/test-debug-server.cpp:464: Failure
    Actual function call count doesn't match EXPECT_CALL(v, visit_init_event(::testing::Field( &trace_stream_event_visitor::init_event::version, ::testing::StrEq("2.10.0"))))...
             Expected: to be called once
               Actual: never called - unsatisfied and active
    .../test/test-debug-server.cpp:461: Failure
    Actual function call count doesn't match EXPECT_CALL(v, visit_packet_header(::testing::_))...
             Expected: to be called once
               Actual: never called - unsatisfied and active
    .../test/test-debug-server.cpp:482: Failure
    Value of: delegate.received_thread_indexes
    Expected: has 3 elements and there exists some permutation of elements such that:
     - element #0 is equal to 1, and
     - element #1 is equal to 2, and
     - element #2 is equal to 3
      Actual: { 3, 1, 2, 3, 1, 2 }, which has 6 elements
    expected three streams: main thread, other thread, debug server thread
    [  FAILED  ] test_debug_server.trace_websocket_sends_trace_data (1 ms)

These failures are caused by the test not handling empty messages
properly. Hackily fix the flaky failure by ignoring empty messages in
the test.
vegerot pushed a commit that referenced this pull request Jan 8, 2024
diagnostic-metadata-debug-generated.cpp contains reflection data (class
member variable names, types, and offsets) for diagnostic classes. This
is a lot of information which is noise when adding new diagnostic types.

Because this data is only used in tests, we have access to the source
code (diagnostic-types-2.h). Move the build-time reflection to run-time
reflection, simplifying patches touching diagnostic-types-2.h.

Debug test times don't seem to be negatively affected by this change:

Before:

    Benchmark #1: ./build/test/quick-lint-js-test --gtest_color=yes --gtest_break_on_failure --gtest_brief=1 --gtest_filter=-Test_Debug_Server.\*:Test_Configuration_Loader.\*:\*SLOW\*
      Time (mean ± σ):     356.9 ms ±   3.1 ms    [User: 319.2 ms, System: 13.6 ms]
      Range (min … max):   352.8 ms … 363.6 ms    10 runs

After:

    Benchmark #1: ./build/test/quick-lint-js-test --gtest_color=yes --gtest_break_on_failure --gtest_brief=1 --gtest_filter=-Test_Debug_Server.\*:Test_Configuration_Loader.\*:\*SLOW\*
      Time (mean ± σ):     352.5 ms ±   5.0 ms    [User: 313.9 ms, System: 15.1 ms]
      Range (min … max):   346.6 ms … 361.6 ms    10 runs
vegerot pushed a commit that referenced this pull request Jan 8, 2024
Linked_Bump_Allocator is coded to align all allocations to 'alignment'
(typically 8). This is problematic for a few reasons:

1. 'alignment' is specified as a compile-time template parameter,
   forcing Linked_Bump_Allocator to be a template. This probably slows
   down compilation and clutters the header file. (This is the main
   problem motivating this patch.)
2. Allocations perform run-time alignment anyways, but on the size
   rather than on the pointer.
3. The forced alignment wastes some space.
4. Linked_Bump_Allocator cannot support overaligned data. (This isn't a
   problem yet, and I don't forsee this being a real problem. I mention
   this for completeness.)

Teach Linked_Bump_Allocator to align everything according to a run-time
alignment. This will let us fix issue #1 later, directly fixes issue #3,
and (with some work included in this patch) fixes #4.

This patch might have negative performance costs. I did not measure.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants