tls: refactor to avoid unsafe array iteration

PR-URL: #36772
Reviewed-By: Rich Trott <rtrott@gmail.com>

Author: aduh95

lib/_tls_common.js

@@ -24,6 +24,7 @@
 const{
  ArrayIsArray,
  ArrayPrototypeFilter,
+ ArrayPrototypeForEach,
  ArrayPrototypeJoin,
  ArrayPrototypePush,
  ObjectCreate,
@@ -142,18 +143,18 @@ function processCiphers(ciphers) {
 return{ cipherList, cipherSuites };
 }
 
-functionaddCACerts(context,...certs){
-for(constcertofcerts){
+functionaddCACerts(context,certs){
+ArrayPrototypeForEach(certs,(cert)=>{
 validateKeyOrCertOption('ca',cert);
 context.addCACert(cert);
-}
+});
 }
 
-functionsetCerts(context,...certs){
-for(constcertofcerts){
+functionsetCerts(context,certs){
+ArrayPrototypeForEach(certs,(cert)=>{
 validateKeyOrCertOption('cert',cert);
 context.setCert(cert);
-}
+});
 }
 
 exports.createSecureContext=functioncreateSecureContext(options){
@@ -196,18 +197,18 @@ exports.createSecureContext = function createSecureContext(options) {
 // change the checks to !== undefined checks.
 if(ca){
 if(ArrayIsArray(ca))
-addCACerts(c.context, ...ca);
-else
 addCACerts(c.context,ca);
+else
+addCACerts(c.context,[ca]);
 }else{
 c.context.addRootCerts();
 }
 
 if(cert){
 if(ArrayIsArray(cert))
-setCerts(c.context, ...cert);
-else
 setCerts(c.context,cert);
+else
+setCerts(c.context,[cert]);
 }
 
 // Set the key after the cert.
@@ -318,15 +319,15 @@ exports.createSecureContext = function createSecureContext(options) {
 
 if(pfx!==undefined){
 if(ArrayIsArray(pfx)){
-for(constvalofpfx){
+ArrayPrototypeForEach(pfx,(val)=>{
 constraw=val.buf ? val.buf : val;
 constpass=val.passphrase||passphrase;
 if(pass!==undefined){
 c.context.loadPKCS12(toBuf(raw),toBuf(pass));
 }else{
 c.context.loadPKCS12(toBuf(raw));
 }
-}
+});
 }elseif(passphrase){
 c.context.loadPKCS12(toBuf(pfx),toBuf(passphrase));
 }else{

lib/internal/tls.js

@@ -2,6 +2,7 @@
 
 const{
  ArrayIsArray,
+ ArrayPrototypeForEach,
  ArrayPrototypePush,
  StringPrototypeIndexOf,
  StringPrototypeSlice,
@@ -13,7 +14,7 @@ const {
 // C=US\nST=CA\nL=SF\nO=Joyent\nOU=Node.js\nCN=ca1\nemailAddress=ry@clouds.org
 functionparseCertString(s){
 constout=ObjectCreate(null);
-for(constpartofStringPrototypeSplit(s,'\n')){
+ArrayPrototypeForEach(StringPrototypeSplit(s,'\n'),(part)=>{
 constsepIndex=StringPrototypeIndexOf(part,'=');
 if(sepIndex>0){
 constkey=StringPrototypeSlice(part,0,sepIndex);
@@ -27,7 +28,7 @@ function parseCertString(s) {
 out[key]=value;
 }
 }
-}
+});
 returnout;
 }
 

lib/tls.js

@@ -24,13 +24,15 @@
 const{
  Array,
  ArrayIsArray,
+ ArrayPrototypeForEach,
  ArrayPrototypeIncludes,
  ArrayPrototypeJoin,
  ArrayPrototypePush,
  ArrayPrototypeReduce,
  ArrayPrototypeSome,
  ObjectDefineProperty,
  ObjectFreeze,
+ ReflectConstruct,
  RegExpPrototypeTest,
  StringFromCharCode,
  StringPrototypeCharCodeAt,
@@ -214,7 +216,7 @@ function check(hostParts, pattern, wildcards) {
 if(patternParts.length<=2)
 returnfalse;
 
-const[prefix,suffix]=patternSubdomainParts;
+const{0: prefix,1: suffix}=patternSubdomainParts;
 
 if(prefix.length+suffix.length>hostSubdomain.length)
 returnfalse;
@@ -239,7 +241,8 @@ exports.checkServerIdentity = function checkServerIdentity(hostname, cert) {
 hostname=''+hostname;
 
 if(altNames){
-for(constnameofStringPrototypeSplit(altNames,', ')){
+constsplitAltNames=StringPrototypeSplit(altNames,', ');
+ArrayPrototypeForEach(splitAltNames,(name)=>{
 if(StringPrototypeStartsWith(name,'DNS:')){
 ArrayPrototypePush(dnsNames,StringPrototypeSlice(name,4));
 }elseif(StringPrototypeStartsWith(name,'URI:')){
@@ -264,7 +267,7 @@ exports.checkServerIdentity = function checkServerIdentity(hostname, cert) {
 }elseif(StringPrototypeStartsWith(name,'IP Address:')){
 ArrayPrototypePush(ips,canonicalizeIP(StringPrototypeSlice(name,11)));
 }
-}
+});
 }
 
 letvalid=false;
@@ -359,7 +362,7 @@ exports.connect = _tls_wrap.connect;
 
 exports.createSecurePair=internalUtil.deprecate(
 functioncreateSecurePair(...args){
-returnnewSecurePair(...args);
+returnReflectConstruct(SecurePair,args);
 },
 'tls.createSecurePair() is deprecated. Please use '+
 'tls.TLSSocket instead.','DEP0064');