Commits on Jan 28, 2019

1. dns: use IDNA 2008 to encode non-ascii hostnames …

   Before this commit, Node.js left it up to the system resolver or c-ares.
   
   Leaving it to the system resolver introduces platform differences
   because:
   
   * some support IDNA 2008
   * some only IDNA 2003 (glibc until 2.28), and
   * some don't support IDNA at all (musl libc)
   
   c-ares doesn't support IDNA either although curl does, by virtue of
   linking against libidn2. Upgrading from libidn1 to libidn2 in order
   to get proper IDNA 2008 support was the fix for curl's CVE-2016-8625.
   
   libidn2 is not an option (incompatible license) but ICU has an IDNA API
   and we already use that in one place. For non-ICU builds, we fall back
   to the bundled punycode.js that also supports IDNA 2008.
   
   Fixes: nodejs-private/security#97
   Fixes: nodejs#25558

   

   bnoordhuis committed Jan 28, 2019
   Configuration menu

   • View commit details
   • Copy full SHA for e3ddd72
   • Browse repository at this point

   Copy the full SHA

   e3ddd72 View commit details

   Browse the repository at this point in the history