timers: make setImmediate() immune to tampering#17736
Closed
Uh oh!
There was an error while loading. Please reload this page.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Make setImmediate() immune to `process` global tampering by removing the dependency on the `process._immediateCallback` property. Fixes: nodejs#17681
nodejs-github-bot added c++ 
addaleax approved these changes Dec 18, 2017
MemberAuthor
bnoordhuis commented Dec 18, 2017
Interesting... CI linting fails but |
cjihrig approved these changes Dec 18, 2017
tniessen approved these changes Dec 18, 2017
apapirovski approved these changes Dec 18, 2017
Fishrock123 approved these changes Dec 18, 2017
| constcommon=require('../common'); | ||
| common.globalCheck=false; | ||
| // eslint-disable-next-line no-global-assign | ||
| process={};// Boom! |
Contributor
There was a problem hiding this comment.
I think you can make it not need the comment by doing global.process ={} instead?
jasnell approved these changes Dec 18, 2017
Contributor
apapirovski commented Dec 26, 2017
Landed in ad02e0d |
apapirovski pushed a commit that referenced this pull request Dec 26, 2017
Make setImmediate() immune to `process` global tampering by removing the dependency on the `process._immediateCallback` property. PR-URL: #17736Fixes: #17681 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Anatoli Papirovski <[email protected]> Reviewed-By: Jeremiah Senkpiel <[email protected]> Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Jan 10, 2018
Make setImmediate() immune to `process` global tampering by removing the dependency on the `process._immediateCallback` property. PR-URL: #17736Fixes: #17681 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Anatoli Papirovski <[email protected]> Reviewed-By: Jeremiah Senkpiel <[email protected]> Reviewed-By: James M Snell <[email protected]>
Merged
Contributor
MylesBorins commented Jan 10, 2018
This is breaking on v9.x, would you be able to manually backport? |
3 tasks
3 tasks
Contributor
apapirovski commented Feb 23, 2018
@MylesBorins this depends on #17198 which was defensively marked as |
apapirovski pushed a commit to apapirovski/node that referenced this pull request Feb 26, 2018
Make setImmediate() immune to `process` global tampering by removing the dependency on the `process._immediateCallback` property. PR-URL: nodejs#17736Fixes: nodejs#17681 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Anatoli Papirovski <[email protected]> Reviewed-By: Jeremiah Senkpiel <[email protected]> Reviewed-By: James M Snell <[email protected]>
addaleax pushed a commit that referenced this pull request Feb 26, 2018
Make setImmediate() immune to `process` global tampering by removing the dependency on the `process._immediateCallback` property. Backport-PR-URL: #19006 PR-URL: #17736Fixes: #17681 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Anatoli Papirovski <[email protected]> Reviewed-By: Jeremiah Senkpiel <[email protected]> Reviewed-By: James M Snell <[email protected]>
addaleax pushed a commit that referenced this pull request Feb 26, 2018
Make setImmediate() immune to `process` global tampering by removing the dependency on the `process._immediateCallback` property. Backport-PR-URL: #19006 PR-URL: #17736Fixes: #17681 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Anatoli Papirovski <[email protected]> Reviewed-By: Jeremiah Senkpiel <[email protected]> Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Feb 26, 2018
Make setImmediate() immune to `process` global tampering by removing the dependency on the `process._immediateCallback` property. Backport-PR-URL: #19006 PR-URL: #17736Fixes: #17681 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Anatoli Papirovski <[email protected]> Reviewed-By: Jeremiah Senkpiel <[email protected]> Reviewed-By: James M Snell <[email protected]>
Closed
Contributor
Should this be backported to This is potentially changing to behavior, even if not wanted behavior |
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make setImmediate() immune to
processglobal tampering by removingthe dependency on the
process._immediateCallbackproperty.Fixes: #17681
CI: https://ci.nodejs.org/job/node-test-commit/14914/CI: https://ci.nodejs.org/job/node-test-commit/14918/