From 3a7a3be034a4f5eec52c2bbab7a21145be6029ca Mon Sep 17 00:00:00 2001
From: Sam Roberts <vieuxtech@gmail.com>
Date: Wed, 20 Nov 2019 11:48:58 -0800
Subject: [PATCH] http: opt-in insecure HTTP header parsing

Allow insecure HTTP header parsing. Make clear it is insecure.

See:
- https://github.com/nodejs/node/pull/30553
- https://github.com/nodejs/node/issues/27711#issuecomment-556265881
- https://github.com/nodejs/node/issues/30515

PR-URL: https://github.com/nodejs/node/pull/30567
Backport-PR-URL: https://github.com/nodejs/node/pull/30473
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/cli.md              | 11 +++++++++++
 doc/node.1                  |  6 ++++++
 lib/_http_client.js         |  4 +++-
 lib/_http_common.js         | 12 ++++++++++++
 lib/_http_server.js         |  4 +++-
 src/node_http_parser_impl.h |  7 +++++--
 src/node_options.cc         |  4 ++++
 src/node_options.h          |  2 ++
 8 files changed, 46 insertions(+), 4 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 488982389c982a..9698ab56864707 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -431,6 +431,16 @@ added: v9.0.0
 Specify the `module` of a custom [experimental ECMAScript Module][] loader.
 `module` may be either a path to a file, or an ECMAScript Module name.
 
+### `--insecure-http-parser`
+<!-- YAML
+added: REPLACEME
+-->
+
+Use an insecure HTTP parser that accepts invalid HTTP headers. This may allow
+interoperability with non-conformant HTTP implementations. It may also allow
+request smuggling and other HTTP attacks that rely on invalid headers being
+accepted. Avoid using this option.
+
 ### `--max-http-header-size=size`
 <!-- YAML
 added: v11.6.0
@@ -1099,6 +1109,7 @@ Node.js options that are allowed are:
 * `--http-server-default-timeout`
 * `--icu-data-dir`
 * `--input-type`
+* `--insecure-http-parser`
 * `--inspect-brk`
 * `--inspect-port`, `--debug-port`
 * `--inspect-publish-uid`
diff --git a/doc/node.1 b/doc/node.1
index 0a55f9334ad4ab..dc175e1381b3e6 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -232,6 +232,12 @@ Specify the
 as a custom loader, to load
 .Fl -experimental-modules .
 .
+.It Fl -insecure-http-parser
+Use an insecure HTTP parser that accepts invalid HTTP headers. This may allow
+interoperability with non-conformant HTTP implementations. It may also allow
+request smuggling and other HTTP attacks that rely on invalid headers being
+accepted. Avoid using this option.
+.
 .It Fl -max-http-header-size Ns = Ns Ar size
 Specify the maximum size of HTTP headers in bytes. Defaults to 8KB.
 .
diff --git a/lib/_http_client.js b/lib/_http_client.js
index 203089ee69d8e1..3c54358b160221 100644
--- a/lib/_http_client.js
+++ b/lib/_http_client.js
@@ -32,6 +32,7 @@ const {
   freeParser,
   parsers,
   HTTPParser,
+  isLenient,
   prepareError,
 } = require('_http_common');
 const { OutgoingMessage } = require('_http_outgoing');
@@ -655,7 +656,8 @@ function tickOnSocket(req, socket) {
   req.socket = socket;
   req.connection = socket;
   parser.initialize(HTTPParser.RESPONSE,
-                    new HTTPClientAsyncResource('HTTPINCOMINGMESSAGE', req));
+                    new HTTPClientAsyncResource('HTTPINCOMINGMESSAGE', req),
+                    isLenient());
   parser.socket = socket;
   parser.outgoing = req;
   req.parser = parser;
diff --git a/lib/_http_common.js b/lib/_http_common.js
index ce3bda91cb64f9..7e58df7f3f3bfa 100644
--- a/lib/_http_common.js
+++ b/lib/_http_common.js
@@ -29,6 +29,7 @@ const { getOptionValue } = require('internal/options');
 const { methods, HTTPParser } =
   getOptionValue('--http-parser') === 'legacy' ?
     internalBinding('http_parser') : internalBinding('http_parser_llhttp');
+const insecureHTTPParser = getOptionValue('--insecure-http-parser');
 
 const FreeList = require('internal/freelist');
 const incoming = require('_http_incoming');
@@ -238,6 +239,16 @@ function prepareError(err, parser, rawPacket) {
     err.message = `Parse Error: ${err.reason}`;
 }
 
+let warnedLenient = false;
+
+function isLenient() {
+  if (insecureHTTPParser && !warnedLenient) {
+    warnedLenient = true;
+    process.emitWarning('Using insecure HTTP parsing');
+  }
+  return insecureHTTPParser;
+}
+
 module.exports = {
   _checkInvalidHeaderChar: checkInvalidHeaderChar,
   _checkIsHttpToken: checkIsHttpToken,
@@ -250,5 +261,6 @@ module.exports = {
   parsers,
   kIncomingMessage,
   HTTPParser,
+  isLenient,
   prepareError,
 };
diff --git a/lib/_http_server.js b/lib/_http_server.js
index 5cea5cd0581b22..0638820a16c939 100644
--- a/lib/_http_server.js
+++ b/lib/_http_server.js
@@ -39,6 +39,7 @@ const {
   chunkExpression,
   kIncomingMessage,
   HTTPParser,
+  isLenient,
   _checkInvalidHeaderChar: checkInvalidHeaderChar,
   prepareError,
 } = require('_http_common');
@@ -385,7 +386,8 @@ function connectionListenerInternal(server, socket) {
   // https://github.com/nodejs/node/pull/21313
   parser.initialize(
     HTTPParser.REQUEST,
-    new HTTPServerAsyncResource('HTTPINCOMINGMESSAGE', socket)
+    new HTTPServerAsyncResource('HTTPINCOMINGMESSAGE', socket),
+    isLenient(),
   );
   parser.socket = socket;
 
diff --git a/src/node_http_parser_impl.h b/src/node_http_parser_impl.h
index 6c00a6e4fd6392..50410dda76f063 100644
--- a/src/node_http_parser_impl.h
+++ b/src/node_http_parser_impl.h
@@ -501,6 +501,7 @@ class Parser : public AsyncWrap, public StreamListener {
 
   static void Initialize(const FunctionCallbackInfo<Value>& args) {
     Environment* env = Environment::GetCurrent(args);
+    bool lenient = args[2]->IsTrue();
 
     CHECK(args[0]->IsInt32());
     CHECK(args[1]->IsObject());
@@ -521,7 +522,7 @@ class Parser : public AsyncWrap, public StreamListener {
 
     parser->set_provider_type(provider);
     parser->AsyncReset(args[1].As<Object>());
-    parser->Init(type);
+    parser->Init(type, lenient);
   }
 
   template <bool should_pause>
@@ -805,12 +806,14 @@ class Parser : public AsyncWrap, public StreamListener {
   }
 
 
-  void Init(parser_type_t type) {
+  void Init(parser_type_t type, bool lenient) {
 #ifdef NODE_EXPERIMENTAL_HTTP
     llhttp_init(&parser_, type, &settings);
+    llhttp_set_lenient(&parser_, lenient);
     header_nread_ = 0;
 #else  /* !NODE_EXPERIMENTAL_HTTP */
     http_parser_init(&parser_, type);
+    parser_.lenient_http_headers = lenient;
 #endif  /* NODE_EXPERIMENTAL_HTTP */
     url_.Reset();
     status_message_.Reset();
diff --git a/src/node_options.cc b/src/node_options.cc
index 01c8c422bba639..e4dee55f26ff8b 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -416,6 +416,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "(default: 120000)",
             &EnvironmentOptions::http_server_default_timeout,
             kAllowedInEnvironment);
+  AddOption("--insecure-http-parser",
+            "Use an insecure HTTP parser that accepts invalid HTTP headers",
+            &EnvironmentOptions::insecure_http_parser,
+            kAllowedInEnvironment);
   AddOption("--input-type",
             "set module type for string input",
             &EnvironmentOptions::module_type,
diff --git a/src/node_options.h b/src/node_options.h
index 6dc4126cdd3ba7..87a0e3b41e14e7 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -159,6 +159,8 @@ class EnvironmentOptions : public Options {
   bool print_eval = false;
   bool force_repl = false;
 
+  bool insecure_http_parser = false;
+
   bool tls_min_v1_0 = false;
   bool tls_min_v1_1 = false;
   bool tls_min_v1_2 = false;