tls: refactor to use more primordials

PR-URL: #36266
Reviewed-By: Rich Trott <rtrott@gmail.com>

Author: aduh95

lib/_tls_common.js

@@ -25,7 +25,9 @@ const {
  ArrayIsArray,
  ArrayPrototypeFilter,
  ArrayPrototypeJoin,
+ ArrayPrototypePush,
  ObjectCreate,
+ StringPrototypeReplace,
  StringPrototypeSplit,
  StringPrototypeStartsWith,
 }=primordials;
@@ -392,12 +394,13 @@ exports.translatePeerCertificate = function translatePeerCertificate(c) {
 c.infoAccess=ObjectCreate(null);
 
 // XXX: More key validation?
-info.replace(/([^\n:]*):([^\n]*)(?:\n|$)/g,(all,key,val)=>{
-if(keyinc.infoAccess)
-c.infoAccess[key].push(val);
-else
-c.infoAccess[key]=[val];
-});
+StringPrototypeReplace(info,/([^\n:]*):([^\n]*)(?:\n|$)/g,
+(all,key,val)=>{
+if(keyinc.infoAccess)
+ArrayPrototypePush(c.infoAccess[key],val);
+else
+c.infoAccess[key]=[val];
+});
 }
 returnc;
 };

lib/_tls_wrap.js

@@ -22,10 +22,18 @@
 'use strict';
 
 const{
+ ArrayPrototypeForEach,
+ ArrayPrototypeJoin,
+ ArrayPrototypePush,
+ FunctionPrototype,
  ObjectAssign,
  ObjectDefineProperty,
  ObjectSetPrototypeOf,
+ ReflectApply,
  RegExp,
+ RegExpPrototypeTest,
+ StringPrototypeReplace,
+ StringPrototypeSlice,
  Symbol,
  SymbolFor,
 }=primordials;
@@ -96,7 +104,7 @@ const kPskIdentityHint = Symbol('pskidentityhint');
 constkPendingSession=Symbol('pendingSession');
 constkIsVerified=Symbol('verified');
 
-constnoop=()=>{};
+constnoop=FunctionPrototype;
 
 letipServernameWarned=false;
 lettlsTracingWarned=false;
@@ -408,7 +416,8 @@ function onerror(err) {
 owner.destroy(err);
 }elseif(owner._tlsOptions.isServer&&
 owner._rejectUnauthorized&&
-/peerdidnotreturnacertificate/.test(err.message)){
+RegExpPrototypeTest(/peerdidnotreturnacertificate/,
+err.message)){
 // Ignore server's authorization errors
 owner.destroy();
 }else{
@@ -496,14 +505,14 @@ function TLSSocket(socket, opts) {
 // distinguishable from regular ones.
 this.encrypted=true;
 
-net.Socket.call(this,{
+ReflectApply(net.Socket,this,[{
 handle: this._wrapHandle(wrap),
 allowHalfOpen: socket ? socket.allowHalfOpen : tlsOptions.allowHalfOpen,
 pauseOnCreate: tlsOptions.pauseOnConnect,
 manualStart: true,
 highWaterMark: tlsOptions.highWaterMark,
 onread: !socket ? tlsOptions.onread : null,
-});
+}]);
 
 // Proxy for API compatibility
 this.ssl=this._handle;// C++ TLSWrap object
@@ -535,7 +544,7 @@ const proxiedMethods = [
 functionmakeMethodProxy(name){
 returnfunctionmethodProxy(...args){
 if(this._parent[name])
-returnthis._parent[name].apply(this._parent,args);
+returnReflectApply(this._parent[name],this._parent,args);
 };
 }
 for(constproxiedMethodofproxiedMethods){
@@ -993,12 +1002,12 @@ TLSSocket.prototype.getCertificate = function() {
 functionmakeSocketMethodProxy(name){
 returnfunctionsocketMethodProxy(...args){
 if(this._handle)
-returnthis._handle[name].apply(this._handle,args);
+returnReflectApply(this._handle[name],this._handle,args);
 returnnull;
 };
 }
 
-[
+ArrayPrototypeForEach([
 'getCipher',
 'getSharedSigalgs',
 'getEphemeralKeyInfo',
@@ -1009,7 +1018,7 @@ function makeSocketMethodProxy(name) {
 'getTLSTicket',
 'isSessionReused',
 'enableTrace',
-].forEach((method)=>{
+],(method)=>{
 TLSSocket.prototype[method]=makeSocketMethodProxy(method);
 });
 
@@ -1209,7 +1218,7 @@ function Server(options, listener) {
 }
 
 // constructor call
-net.Server.call(this,options,tlsConnectionListener);
+ReflectApply(net.Server,this,[options,tlsConnectionListener]);
 
 if(listener){
 this.on('secureConnection',listener);
@@ -1309,10 +1318,10 @@ Server.prototype.setSecureContext = function(options) {
 if(options.sessionIdContext){
 this.sessionIdContext=options.sessionIdContext;
 }else{
-this.sessionIdContext=crypto.createHash('sha1')
-.update(process.argv.join(' '))
-.digest('hex')
-.slice(0,32);
+this.sessionIdContext=StringPrototypeSlice(
+crypto.createHash('sha1')
+.update(ArrayPrototypeJoin(process.argv,' '))
+.digest('hex'),0,32);
 }
 
 if(options.sessionTimeout)
@@ -1399,10 +1408,10 @@ Server.prototype.setOptions = deprecate(function(options) {
 if(options.sessionIdContext){
 this.sessionIdContext=options.sessionIdContext;
 }else{
-this.sessionIdContext=crypto.createHash('sha1')
-.update(process.argv.join(' '))
-.digest('hex')
-.slice(0,32);
+this.sessionIdContext=StringPrototypeSlice(
+crypto.createHash('sha1')
+.update(ArrayPrototypeJoin(process.argv,' '))
+.digest('hex'),0,32);
 }
 if(options.pskCallback)this[kPskCallback]=options.pskCallback;
 if(options.pskIdentityHint)this[kPskIdentityHint]=options.pskIdentityHint;
@@ -1414,11 +1423,12 @@ Server.prototype.addContext = function(servername, context) {
 thrownewERR_TLS_REQUIRED_SERVER_NAME();
 }
 
-constre=newRegExp('^'+
-servername.replace(/([.^$+?\-\\[\]{}])/g,'\\$1')
-.replace(/\*/g,'[^.]*')+
-'$');
-this._contexts.push([re,tls.createSecureContext(context).context]);
+constre=newRegExp('^'+StringPrototypeReplace(
+StringPrototypeReplace(servername,/([.^$+?\-\\[\]{}])/g,'\\$1'),
+/\*/g,'[^.]*'
+)+'$');
+ArrayPrototypePush(this._contexts,
+[re,tls.createSecureContext(context).context]);
 };
 
 Server.prototype[EE.captureRejectionSymbol]=function(
@@ -1429,16 +1439,16 @@ Server.prototype[EE.captureRejectionSymbol] = function(
 sock.destroy(err);
 break;
 default:
-net.Server.prototype[SymbolFor('nodejs.rejection')]
-.call(this,err,event,sock);
+ReflectApply(net.Server.prototype[SymbolFor('nodejs.rejection')],this,
+[err,event,sock]);
 }
 };
 
 functionSNICallback(servername,callback){
 constcontexts=this.server._contexts;
 
 for(constelemofcontexts){
-if(elem[0].test(servername)){
+if(RegExpPrototypeTest(elem[0],servername)){
 callback(null,elem[1]);
 return;
 }

lib/internal/tls.js

@@ -2,23 +2,27 @@
 
 const{
  ArrayIsArray,
+ ArrayPrototypePush,
+ StringPrototypeIndexOf,
+ StringPrototypeSlice,
+ StringPrototypeSplit,
  ObjectCreate,
 }=primordials;
 
 // Example:
 // C=US\nST=CA\nL=SF\nO=Joyent\nOU=Node.js\nCN=ca1\nemailAddress=ry@clouds.org
 functionparseCertString(s){
 constout=ObjectCreate(null);
-for(constpartofs.split('\n')){
-constsepIndex=part.indexOf('=');
+for(constpartofStringPrototypeSplit(s,'\n')){
+constsepIndex=StringPrototypeIndexOf(part,'=');
 if(sepIndex>0){
-constkey=part.slice(0,sepIndex);
-constvalue=part.slice(sepIndex+1);
+constkey=StringPrototypeSlice(part,0,sepIndex);
+constvalue=StringPrototypeSlice(part,sepIndex+1);
 if(keyinout){
 if(!ArrayIsArray(out[key])){
 out[key]=[out[key]];
 }
-out[key].push(value);
+ArrayPrototypePush(out[key],value);
 }else{
 out[key]=value;
 }

lib/tls.js

@@ -24,12 +24,22 @@
 const{
  Array,
  ArrayIsArray,
+ ArrayPrototypeIncludes,
+ ArrayPrototypeJoin,
+ ArrayPrototypePush,
+ ArrayPrototypeReduce,
+ ArrayPrototypeSome,
  ObjectDefineProperty,
  ObjectFreeze,
+ RegExpPrototypeTest,
  StringFromCharCode,
  StringPrototypeCharCodeAt,
+ StringPrototypeEndsWith,
+ StringPrototypeIncludes,
  StringPrototypeReplace,
+ StringPrototypeSlice,
  StringPrototypeSplit,
+ StringPrototypeStartsWith,
 }=primordials;
 
 const{
@@ -107,7 +117,7 @@ ObjectDefineProperty(exports, 'rootCertificates', {
 // ("\x06spdy/2\x08http/1.1\x08http/1.0")
 functionconvertProtocols(protocols){
 constlens=newArray(protocols.length);
-constbuff=Buffer.allocUnsafe(protocols.reduce((p,c,i)=>{
+constbuff=Buffer.allocUnsafe(ArrayPrototypeReduce(protocols,(p,c,i)=>{
 constlen=Buffer.byteLength(c);
 if(len>255){
 thrownewERR_OUT_OF_RANGE('The byte length of the protocol at index '+
@@ -138,7 +148,7 @@ exports.convertALPNProtocols = function convertALPNProtocols(protocols, out) {
 };
 
 functionunfqdn(host){
-returnhost.replace(/[.]$/,'');
+returnStringPrototypeReplace(host,/[.]$/,'');
 }
 
 // String#toLowerCase() is locale-sensitive so we use
@@ -165,15 +175,15 @@ function check(hostParts, pattern, wildcards) {
 returnfalse;
 
 // Pattern has empty components, e.g. "bad..example.com".
-if(patternParts.includes(''))
+if(ArrayPrototypeIncludes(patternParts,''))
 returnfalse;
 
 // RFC 6125 allows IDNA U-labels (Unicode) in names but we have no
 // good way to detect their encoding or normalize them so we simply
 // reject them. Control characters and blanks are rejected as well
 // because nothing good can come from accepting them.
-constisBad=(s)=>/[^\u0021-\u007F]/u.test(s);
-if(patternParts.some(isBad))
+constisBad=(s)=>RegExpPrototypeTest(/[^\u0021-\u007F]/u,s);
+if(ArrayPrototypeSome(patternParts,isBad))
 returnfalse;
 
 // Check host parts from right to left first.
@@ -184,12 +194,13 @@ function check(hostParts, pattern, wildcards) {
 
 consthostSubdomain=hostParts[0];
 constpatternSubdomain=patternParts[0];
-constpatternSubdomainParts=patternSubdomain.split('*');
+constpatternSubdomainParts=StringPrototypeSplit(patternSubdomain,'*');
 
 // Short-circuit when the subdomain does not contain a wildcard.
 // RFC 6125 does not allow wildcard substitution for components
 // containing IDNA A-labels (Punycode) so match those verbatim.
-if(patternSubdomainParts.length===1||patternSubdomain.includes('xn--'))
+if(patternSubdomainParts.length===1||
+StringPrototypeIncludes(patternSubdomain,'xn--'))
 returnhostSubdomain===patternSubdomain;
 
 if(!wildcards)
@@ -208,10 +219,10 @@ function check(hostParts, pattern, wildcards) {
 if(prefix.length+suffix.length>hostSubdomain.length)
 returnfalse;
 
-if(!hostSubdomain.startsWith(prefix))
+if(!StringPrototypeStartsWith(hostSubdomain,prefix))
 returnfalse;
 
-if(!hostSubdomain.endsWith(suffix))
+if(!StringPrototypeEndsWith(hostSubdomain,suffix))
 returnfalse;
 
 returntrue;
@@ -228,28 +239,30 @@ exports.checkServerIdentity = function checkServerIdentity(hostname, cert) {
 hostname=''+hostname;
 
 if(altNames){
-for(constnameofaltNames.split(', ')){
-if(name.startsWith('DNS:')){
-dnsNames.push(name.slice(4));
-}elseif(name.startsWith('URI:')){
+for(constnameofStringPrototypeSplit(altNames,', ')){
+if(StringPrototypeStartsWith(name,'DNS:')){
+ArrayPrototypePush(dnsNames,StringPrototypeSlice(name,4));
+}elseif(StringPrototypeStartsWith(name,'URI:')){
 leturi;
 try{
-uri=newURL(name.slice(4));
+uri=newURL(StringPrototypeSlice(name,4));
 }catch{
-uri=url.parse(name.slice(4));
+constslicedName=StringPrototypeSlice(name,4);
+uri=url.parse(slicedName);
 if(!urlWarningEmitted&&!process.noDeprecation){
 urlWarningEmitted=true;
 process.emitWarning(
-`The URI ${name.slice(4)} found in cert.subjectaltname `+
+`The URI ${slicedName} found in cert.subjectaltname `+
 'is not a valid URI, and is supported in the tls module '+
 'solely for compatibility.',
 'DeprecationWarning','DEP0109');
 }
 }
 
-uriNames.push(uri.hostname);// TODO(bnoordhuis) Also use scheme.
-}elseif(name.startsWith('IP Address:')){
-ips.push(canonicalizeIP(name.slice(11)));
+// TODO(bnoordhuis) Also use scheme.
+ArrayPrototypePush(uriNames,uri.hostname);
+}elseif(StringPrototypeStartsWith(name,'IP Address:')){
+ArrayPrototypePush(ips,canonicalizeIP(StringPrototypeSlice(name,11)));
 }
 }
 }
@@ -263,17 +276,19 @@ exports.checkServerIdentity = function checkServerIdentity(hostname, cert) {
 hostname=unfqdn(hostname);// Remove trailing dot for error messages.
 
 if(net.isIP(hostname)){
-valid=ips.includes(canonicalizeIP(hostname));
+valid=ArrayPrototypeIncludes(ips,canonicalizeIP(hostname));
 if(!valid)
-reason=`IP: ${hostname} is not in the cert's list: ${ips.join(', ')}`;
+reason=`IP: ${hostname} is not in the cert's list: `+
+ArrayPrototypeJoin(ips,', ');
 // TODO(bnoordhuis) Also check URI SANs that are IP addresses.
 }elseif(hasAltNames||subject){
 consthostParts=splitHost(hostname);
 constwildcard=(pattern)=>check(hostParts,pattern,true);
 
 if(hasAltNames){
 constnoWildcard=(pattern)=>check(hostParts,pattern,false);
-valid=dnsNames.some(wildcard)||uriNames.some(noWildcard);
+valid=ArrayPrototypeSome(dnsNames,wildcard)||
+ArrayPrototypeSome(uriNames,noWildcard);
 if(!valid)
 reason=
 `Host: ${hostname}. is not in the cert's altnames: ${altNames}`;
@@ -282,7 +297,7 @@ exports.checkServerIdentity = function checkServerIdentity(hostname, cert) {
 constcn=subject.CN;
 
 if(ArrayIsArray(cn))
-valid=cn.some(wildcard);
+valid=ArrayPrototypeSome(cn,wildcard);
 elseif(cn)
 valid=wildcard(cn);