Dmitry Volyntsev [Thu, 27 Feb 2025 06:12:31 +0000 (22:12 -0800)]
XML: fixed serializeToString().
Previously, serializeToString() was exclusiveC14n() which returned
string instead of Buffer. According to the published documentation it
should be c14n().
Dmitry Volyntsev [Thu, 13 Feb 2025 03:11:08 +0000 (19:11 -0800)]
QuickJS: fixed non-NULL terminated strings formatting in exceptions.
When "%*s" is specified, the first integer is interpreted as width.
Width specifies *minimum* number of characters to output. The next
string is expected to be NULL-terminated.
When "%.*s" is specified, the first integer is interpreted as precision.
Precision specifies *maximum* number of characters to output.
Dmitry Volyntsev [Wed, 12 Feb 2025 00:41:56 +0000 (16:41 -0800)]
Fixed access to uninitialized alg in SubtleCrypto.import().
Found by GCC:
In function ‘qjs_import_jwk_oct’,
external/qjs_webcrypto_module.c:3116:13: error: ‘alg.start’ may be used uninitialized [-Werror=maybe-uninitialized]
3116 | JS_ThrowTypeError(cx, "key size and \"alg\" value \"%s\" mismatch",
The similar place in the NJS module was also fixed.
Modules: fixed name corruption in variable and header processing.
The HTTP and Stream JS modules were performing in-place lowercasing of
variable and header names, which could inadvertently overwrite the
original data.
In the NJS engine, the problem did not manifest itself for strings up to
14 bytes long because they are inlined into the value.
Previously, when js_import was declared in http or stream blocks, an extra
copy of the VM instance was created for each server block. This was not
needed and consumed a lot of memory for configurations with many server
blocks.
This issue was introduced in 9b674412 (0.8.6) and was
partially fixed for location blocks only in 685b64f0 (0.8.7).
To ensure optimal use of memory, SSL contexts for ngx.fetch() are now
inherited from previous levels as long as relevant js_fetch_* directives
are not redefined.
Dmitry Volyntsev [Tue, 26 Nov 2024 05:43:44 +0000 (21:43 -0800)]
HTTP: fixed limit rated output.
Previously, when r.return(code, body) was called from a subrequest
handler with a body size larger than the sendfile_max_chunk value
connection hanging might occur.
Previously, njs_promise_resolve() might return njs_object_t instead of
njs_promise_t. Later an instance of njs_object_t was put into a
NJS_PROMISE value. Whereas njs_promise_t is always expected to be inside
of a NJS_PROMISE value.
src/qjs.c:347:19: error: variable 'signo' may be uninitialized when used
here [-Werror,-Wconditional-uninitialized]
347 | if (kill(pid, signo) < 0) {
| ^~~~~
src/qjs.c:294:31: note: initialize the variable 'signo' to silence this
warning
294 | int signo, pid;
| ^
| = 0
1 error generated.
Dmitry Volyntsev [Sat, 19 Oct 2024 01:24:49 +0000 (18:24 -0700)]
Improved error messages for module loading failures.
There are several reasons why a file cannot be opened. Without
extra information, especially in containerized environments, these
problems are difficult to debug. Adding errno status to the
error output helps identify the root cause.
Additionally, error messages are now aligned between njs and QuickJS.
Dmitry Volyntsev [Wed, 16 Oct 2024 01:28:19 +0000 (18:28 -0700)]
Implemented lazy stack symbolization.
Previously, when an exception was thrown, the exception got 'stack'
property attached which contained the backtrace information about where
the exception happened. This could be a heavy operation and it was not
always needed.
To optimize it, the process is split into 2 phases. The first phase
collects all the necessary info about the current stack. The second
phase, where the stack symbolization happens, occurs only when this
property is referenced.
Dmitry Volyntsev [Sat, 12 Oct 2024 00:23:42 +0000 (17:23 -0700)]
Modules: removed extra VMs creation when it is not needed.
Previously, a new VM instance was created for every location. This is
not needed and consumes a lot of memory for large configurations.
Instead, if no new js_import is introduced on the location level server
level VM should be used.
Dmitry Volyntsev [Thu, 10 Oct 2024 00:32:11 +0000 (17:32 -0700)]
Fixed heap-buffer-overflow in Buffer.prototype.indexOf().
Previously, when `from` argument was provided heap-buffer-overflow might
happen due to lack of boundary check. `to = njs_min(to, length)`
statement was also removed because it has no effect, `to` is
equal to `length` here.