Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
http: unset
F_CHUNKED
on new Transfer-Encoding
Duplicate `Transfer-Encoding` header should be a treated as a single, but with original header values concatenated with a comma separator. In the light of this, even if the past `Transfer-Encoding` ended with `chunked`, we should be not let the `F_CHUNKED` to leak into the next header, because mere presence of another header indicates that `chunked` is not the last transfer-encoding token. Ref: nodejs-private/llhttp-private#3 See: https://hackerone.com/bugs?report_id=1002188&subject=nodejs CVE-ID: CVE-2020-8287 PR-URL: nodejs-private/node-private#236 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
- Loading branch information
1 parent
4a30ac8
commit 420244e
Showing
2 changed files
with
80 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,46 @@ | ||
'use strict'; | ||
|
||
const common = require('../common'); | ||
|
||
const assert = require('assert'); | ||
const http = require('http'); | ||
const net = require('net'); | ||
|
||
const msg = [ | ||
'POST / HTTP/1.1', | ||
'Host: 127.0.0.1', | ||
'Transfer-Encoding: chunked', | ||
'Transfer-Encoding: chunked-false', | ||
'Connection: upgrade', | ||
'', | ||
'1', | ||
'A', | ||
'0', | ||
'', | ||
'GET /flag HTTP/1.1', | ||
'Host: 127.0.0.1', | ||
'', | ||
'', | ||
].join('\r\n'); | ||
|
||
// Verify that the server is called only once even with a smuggled request. | ||
|
||
const server = http.createServer(common.mustCall((req, res) => { | ||
res.end(); | ||
}, 1)); | ||
|
||
function send(next) { | ||
const client = net.connect(server.address().port, 'localhost'); | ||
client.setEncoding('utf8'); | ||
client.on('error', common.mustNotCall()); | ||
client.on('end', next); | ||
client.write(msg); | ||
client.resume(); | ||
} | ||
|
||
server.listen(0, common.mustCall((err) => { | ||
assert.ifError(err); | ||
send(common.mustCall(() => { | ||
server.close(); | ||
})); | ||
})); |