mirror of
https://github.com/nodejs/node.git
synced 2024-11-21 10:59:27 +00:00
fe3975783c
HTTP header values can have trailing OWS, but it should be stripped. It is not semantically part of the header's value, and if treated as part of the value, it can cause spurious inequality between expected and actual header values. Note that a single SPC of leading OWS is common before the field-value, and it is already handled by the HTTP parser by stripping all leading OWS. It is only the trailing OWS that must be stripped by the parser user. header-field = field-name ":" OWS field-value OWS ; https://tools.ietf.org/html/rfc7230#section-3.2 OWS = *( SP / HTAB ) ; https://tools.ietf.org/html/rfc7230#section-3.2.3 Fixes: https://hackerone.com/reports/730779 PR-URL: https://github.com/nodejs-private/node-private/pull/189 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com>
50 lines
1.5 KiB
JavaScript
50 lines
1.5 KiB
JavaScript
'use strict';
|
|
const common = require('../common');
|
|
|
|
// This test ensures that the http-parser strips leading and trailing OWS from
|
|
// header values. It sends the header values in chunks to force the parser to
|
|
// build the string up through multiple calls to on_header_value().
|
|
|
|
const assert = require('assert');
|
|
const http = require('http');
|
|
const net = require('net');
|
|
|
|
function check(hdr, snd, rcv) {
|
|
const server = http.createServer(common.mustCall((req, res) => {
|
|
assert.strictEqual(req.headers[hdr], rcv);
|
|
req.pipe(res);
|
|
}));
|
|
|
|
server.listen(0, common.mustCall(function() {
|
|
const client = net.connect(this.address().port, start);
|
|
function start() {
|
|
client.write('GET / HTTP/1.1\r\n' + hdr + ':', drain);
|
|
}
|
|
|
|
function drain() {
|
|
if (snd.length === 0) {
|
|
return client.write('\r\nConnection: close\r\n\r\n');
|
|
}
|
|
client.write(snd.shift(), drain);
|
|
}
|
|
|
|
const bufs = [];
|
|
client.on('data', function(chunk) {
|
|
bufs.push(chunk);
|
|
});
|
|
client.on('end', common.mustCall(function() {
|
|
const head = Buffer.concat(bufs)
|
|
.toString('latin1')
|
|
.split('\r\n')[0];
|
|
assert.strictEqual(head, 'HTTP/1.1 200 OK');
|
|
server.close();
|
|
}));
|
|
}));
|
|
}
|
|
|
|
check('host', [' \t foo.com\t'], 'foo.com');
|
|
check('host', [' \t foo\tcom\t'], 'foo\tcom');
|
|
check('host', [' \t', ' ', ' foo.com\t', '\t '], 'foo.com');
|
|
check('host', [' \t', ' \t'.repeat(100), '\t '], '');
|
|
check('host', [' \t', ' - - - - ', '\t '], '- - - -');
|