You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

164 lines
4.8 KiB

node: bump to v16.17.1 The following CVEs are fixed in this release: * CVE-2022-32212: DNS rebinding in --inspect on macOS (High) * Insufficient fix for macOS devices on v18.5.0 * CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium) * CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium) * Insufficient fix on v18.5.0 * CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium) * Insufficient fix on v18.5.0 * CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium) * CVE-2022-35255: Weak randomness in WebCrypto keygen More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post. llhttp updated to 6.0.10 llhttp is updated to 6.0.10 which includes fixes for the following vulnerabilities. * HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). * HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). * HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the http does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS). Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com> (cherry picked from commit 658621bf5eec076f6f1a7d12b29105fba279a379)
2 years ago
node: bump to v16.17.1 The following CVEs are fixed in this release: * CVE-2022-32212: DNS rebinding in --inspect on macOS (High) * Insufficient fix for macOS devices on v18.5.0 * CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium) * CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium) * Insufficient fix on v18.5.0 * CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium) * Insufficient fix on v18.5.0 * CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium) * CVE-2022-35255: Weak randomness in WebCrypto keygen More detailed information on each of the vulnerabilities can be found in September 22nd 2022 Security Releases blog post. llhttp updated to 6.0.10 llhttp is updated to 6.0.10 which includes fixes for the following vulnerabilities. * HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)(CVE-2022-32213 ): The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). * HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215): The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). * HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)(CVE-35256): The llhttp parser in the http does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS). Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com> (cherry picked from commit 658621bf5eec076f6f1a7d12b29105fba279a379)
2 years ago
  1. #
  2. # Copyright (C) 2006-2017 OpenWrt.org
  3. #
  4. # This is free software, licensed under the GNU General Public License v2.
  5. # See /LICENSE for more information.
  6. #
  7. include $(TOPDIR)/rules.mk
  8. PKG_NAME:=node
  9. PKG_VERSION:=v16.17.1
  10. PKG_RELEASE:=1
  11. PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
  12. PKG_SOURCE_URL:=https://nodejs.org/dist/$(PKG_VERSION)
  13. PKG_HASH:=6721feb4152d56d2c6b358ce397abd5a7f1daf09ee2e25c5021b9b4d3f86a330
  14. PKG_MAINTAINER:=Hirokazu MORIKAWA <morikw2@gmail.com>, Adrian Panella <ianchi74@outlook.com>
  15. PKG_LICENSE:=MIT
  16. PKG_LICENSE_FILES:=LICENSE
  17. PKG_CPE_ID:=cpe:/a:nodejs:node.js
  18. HOST_BUILD_DEPENDS:=python3/host
  19. HOST_BUILD_PARALLEL:=1
  20. PKG_BUILD_DEPENDS:=python3/host
  21. PKG_BUILD_PARALLEL:=1
  22. PKG_INSTALL:=1
  23. PKG_USE_MIPS16:=0
  24. PKG_ASLR_PIE:=0
  25. include $(INCLUDE_DIR)/host-build.mk
  26. include $(INCLUDE_DIR)/package.mk
  27. define Package/node
  28. SECTION:=lang
  29. CATEGORY:=Languages
  30. SUBMENU:=Node.js
  31. TITLE:=Node.js is a platform built on Chrome's JavaScript runtime
  32. URL:=https://nodejs.org/
  33. DEPENDS:=@HAS_FPU @(i386||x86_64||arm||aarch64||mipsel) \
  34. +libstdcpp +libopenssl +zlib +libnghttp2 +libuv \
  35. +libcares +libatomic +NODEJS_ICU_SYSTEM:icu +NODEJS_ICU_SYSTEM:icu-full-data
  36. endef
  37. define Package/node/description
  38. Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine. Node.js uses
  39. an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js'
  40. package ecosystem, npm, is the largest ecosystem of open source libraries in the world.
  41. *** The following preparations must be made on the host side. ***
  42. 1. gcc 8.3 or higher is required.
  43. 2. To build a 32-bit target, gcc-multilib, g++-multilib are required.
  44. 3. Requires libatomic package. (If necessary, install the 32-bit library at the same time.)
  45. ex) sudo apt-get install gcc-multilib g++-multilib
  46. endef
  47. define Package/node-npm
  48. SECTION:=lang
  49. CATEGORY:=Languages
  50. SUBMENU:=Node.js
  51. TITLE:=NPM stands for Node Package Manager
  52. URL:=https://www.npmjs.com/
  53. DEPENDS:=+node
  54. endef
  55. define Package/node-npm/description
  56. NPM is the package manager for NodeJS
  57. endef
  58. define Package/node/config
  59. if PACKAGE_node
  60. choice
  61. prompt "i18n features"
  62. default NODEJS_ICU_SMALL
  63. help
  64. Select i18n features
  65. config NODEJS_ICU_NONE
  66. bool "Disable"
  67. config NODEJS_ICU_SMALL
  68. bool "small-icu"
  69. config NODEJS_ICU_SYSTEM
  70. depends on ARCH_64BIT
  71. bool "system-icu"
  72. endchoice
  73. endif
  74. endef
  75. NODEJS_CPU:=$(subst aarch64,arm64,$(subst x86_64,x64,$(subst i386,ia32,$(ARCH))))
  76. ifneq ($(CONFIG_ARCH_64BIT),y)
  77. FORCE_32BIT:=-m32
  78. endif
  79. MAKE_VARS+= \
  80. DESTCPU=$(NODEJS_CPU) \
  81. NO_LOAD='cctest.target.mk embedtest.target.mk node_mksnapshot.target.mk overlapped-checker.target.mk \
  82. mkcodecache.target.mk tools/v8_gypfiles/torque_base.target.mk tools/v8_gypfiles/v8_init.target.mk' \
  83. LD_LIBRARY_PATH=$(STAGING_DIR_HOSTPKG)/share/icu/current/lib
  84. HOST_MAKE_VARS+=NO_LOAD='cctest.target.mk embedtest.target.mk overlapped-checker.target.mk'
  85. CONFIGURE_VARS:= \
  86. CC="$(TARGET_CC) $(TARGET_OPTIMIZATION)" \
  87. CXX="$(TARGET_CXX) $(TARGET_OPTIMIZATION)" \
  88. CC_host="$(HOSTCC) $(FORCE_32BIT)" \
  89. CXX_host="$(HOSTCXX) $(FORCE_32BIT)"
  90. CONFIGURE_ARGS:= \
  91. --dest-cpu=$(NODEJS_CPU) \
  92. --dest-os=linux \
  93. --cross-compiling \
  94. --shared-zlib \
  95. --shared-openssl \
  96. --shared-nghttp2 \
  97. --shared-libuv \
  98. --shared-cares \
  99. --with-intl=$(if $(CONFIG_NODEJS_ICU_SMALL),small-icu,$(if $(CONFIG_NODEJS_ICU_SYSTEM),system-icu,none)) \
  100. $(if $(findstring +neon,$(CONFIG_CPU_TYPE)),--with-arm-fpu=neon) \
  101. $(if $(findstring +vfp",$(CONFIG_CPU_TYPE)),--with-arm-fpu=vfp) \
  102. $(if $(findstring +vfpv3",$(CONFIG_CPU_TYPE)),--with-arm-fpu=vfpv3-d16) \
  103. $(if $(findstring +vfpv4",$(CONFIG_CPU_TYPE)),--with-arm-fpu=vfpv3) \
  104. --prefix=/usr
  105. HOST_CONFIGURE_VARS:=
  106. HOST_CONFIGURE_ARGS:= \
  107. --dest-os=$(if $(findstring Darwin,$(HOST_OS)),mac,linux) \
  108. --with-intl=small-icu \
  109. --prefix=$(STAGING_DIR_HOSTPKG)
  110. define Build/InstallDev
  111. $(INSTALL_DIR) $(1)/usr/include
  112. $(CP) $(PKG_INSTALL_DIR)/usr/include/* $(1)/usr/include/
  113. endef
  114. define Package/node/install
  115. $(INSTALL_DIR) $(1)/usr/bin
  116. $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/node $(1)/usr/bin/
  117. endef
  118. define Package/node-npm/install
  119. $(INSTALL_DIR) $(1)/usr/lib/node_modules/npm
  120. $(CP) $(PKG_INSTALL_DIR)/usr/lib/node_modules/npm/{package.json,LICENSE} \
  121. $(1)/usr/lib/node_modules/npm/
  122. $(CP) $(PKG_INSTALL_DIR)/usr/lib/node_modules/npm/README.md \
  123. $(1)/usr/lib/node_modules/npm/
  124. $(CP) $(PKG_INSTALL_DIR)/usr/lib/node_modules/npm/{node_modules,bin,lib} \
  125. $(1)/usr/lib/node_modules/npm/
  126. $(INSTALL_DIR) $(1)/usr/bin
  127. $(LN) ../lib/node_modules/npm/bin/npm-cli.js $(1)/usr/bin/npm
  128. $(LN) ../lib/node_modules/npm/bin/npx-cli.js $(1)/usr/bin/npx
  129. endef
  130. define Host/Install
  131. $(RM) -rf $(1)/lib/node_modules/npm
  132. $(call Host/Install/Default)
  133. endef
  134. $(eval $(call HostBuild))
  135. $(eval $(call BuildPackage,node))
  136. $(eval $(call BuildPackage,node-npm))