http: server check Host header in request, to meet RFC 7230 5.4 requirement #45597

marco-ippolito · 2022-11-23T11:40:05Z

Since the author of the previous PR #39322 was absent for more than a year I've decided to take it, resolve conflicts and create a new PR.
Resolves: #39033

nodejs-github-bot · 2022-11-23T11:40:09Z

Review requested:

@nodejs/http
@nodejs/net

ShogunPanda

LGTM!

nodejs-github-bot · 2022-11-23T12:53:45Z

CI: https://ci.nodejs.org/job/node-test-pull-request/48119/

lib/_http_server.js

mcollina

lgtm

lib/_http_server.js

bnoordhuis

Is there a test that checks a 400 is sent back? Plenty of updated tests but none that seem to test the new behavior. :-)

test/parallel/test-http-max-headers-count.js

test/parallel/test-https-max-headers-count.js

lib/_http_server.js

bnoordhuis · 2022-11-24T20:59:09Z

macos test failure appears to be relevant?

nodejs-github-bot · 2022-11-25T09:13:08Z

CI: https://ci.nodejs.org/job/node-test-pull-request/48177/

nodejs-github-bot · 2022-11-25T14:15:33Z

CI: https://ci.nodejs.org/job/node-test-pull-request/48180/

Co-authored-by: Luigi Pinca <luigipinca@gmail.com>

Co-authored-by: mscdex <mscdex@users.noreply.github.com>

ShogunPanda · 2022-11-28T17:42:26Z

@nodejs/build @nodejs/tsc After merging this PR with node-core-utils somehow the original author of the PR is missing in the commit. How do I fix this situation?

aduh95 · 2022-11-28T18:02:13Z

After merging this PR with node-core-utils somehow the original author of the PR is missing in the commit. How do I fix this situation?

There's a 10-minute time window where it's allowed to force-push to remove a commit that landed when it shouldn't have / when it's lacking the correct metadata (here the author).

node/doc/contributing/collaborator-guide.md

Lines 743 to 753 in a01dbf1

    
           ### I made a mistake 
        
           * Ping a TSC member. 
        
           * With `git`, there's a way to override remote trees by force pushing 
        
             (`git push -f`). This is generally forbidden as it creates conflicts in other 
        
             people's forks. It is permissible for simpler slip-ups such as typos in commit 
        
             messages. You are only allowed to force push to any Node.js branch within 10 
        
             minutes from your original push. If someone else pushes to the branch or the 
        
             10-minute period passes, consider the commit final. 
        
             * Use `--force-with-lease` to reduce the chance of overwriting someone else's 
        
               change.

ShogunPanda · 2022-11-28T18:13:45Z

~~Yes I know that. But I noticed after the 10 minutes window. So there's no way to acknowledge the author anymore I guess, right?~~

I spoke personally to the author and apologize for the mistake. We can go on with this.

Author: PR-URL: nodejs#45597 Fixes: nodejs#39033 Co-authored-by: Luigi Pinca <luigipinca@gmail.com> Co-authored-by: mscdex <mscdex@users.noreply.github.com> Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

PR-URL: nodejs#45597 Fixes: nodejs#39033 Co-authored-by: Luigi Pinca <luigipinca@gmail.com> Co-authored-by: mscdex <mscdex@users.noreply.github.com> Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Notable Changes: crypto: * (SEMVER-MAJOR) use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 src,process: * (SEMVER-MINOR) add permission model (Rafael Gonzaga) #44004 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MAJOR) runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 Semver-Major Commits: * [9fafb0a] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432 * [1948d37] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599 * [7bc0e6a] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153 * [671ffd7] - (SEMVER-MAJOR) buffer: use min/max of `validateNumber` (Deokjin Kim) #45796 * [ab1614d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251 * [c1bcdbc] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806 * [649f68f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579 * [9374700] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182 * [1640aeb] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073 * [c2e4b1f] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028 * [3ef38c4] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 * [08af023] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653 * [7eb0ac3] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251 * [a7c129f] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251 * [6f5655a] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #47251 * [f226350] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251 * [d6dae74] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël Zasso) #45579 * [56c4365] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579 * [51ab98c] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579 * [9f84d3e] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579 * [f2318cd] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579 * [16e03e7] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579 * [6473f5e] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352 * [cc18fd9] - (SEMVER-MAJOR) events: refactor to use `validateNumber` (Deokjin Kim) #45770 * [ff92b40] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333 * [2a29df6] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331 * [391dc74] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283 * [ed3604c] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (wwwzbwcom) #45597 * [4b08c4c] - (SEMVER-MAJOR) lib: runtime deprecate punycode (Yagiz Nizipli) #47202 * [88d71dc] - (SEMVER-MAJOR) lib: refactor to use min/max of `validateNumber` (Deokjin Kim) #45772 * [e4d641f] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174 * [0f3e531] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276 * [5b5898a] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841 * [8b51c1a] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790 * [2d0d997] - (SEMVER-MAJOR) process: remove `process.exit()`, `process.exitCode` coercion to integer (Daeyeon Jeong) #43716 * [dc06df3] - (SEMVER-MAJOR) readline: refactor to use `validateNumber` (Deokjin Kim) #45801 * [295b2f3] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251 * [3803b02] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825 * [e8bddac] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705 * [f84de0a] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427 * [a624277] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579 * [dd5c39a] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579 * [63eca7f] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430 * [9e7093f] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322 * [fb91ee4] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579 * [eca6180] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579 * [c03354d] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508 * [c733cc0] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983 * [7ce2232] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251 * [ca4bd30] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251 * [58b06a2] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579 * [027841c] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904 * [3bed5f1] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 * [7c76fdd] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718 * [7efae93] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #47441

Notable Changes: crypto: * (SEMVER-MAJOR) use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 sea: * use JSON configuration and blob content for SEA (Joyee Cheung) #47125 src,process: * (SEMVER-MINOR) add permission model (Rafael Gonzaga) #44004 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MAJOR) runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 Semver-Major Commits: * [9fafb0a] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432 * [1948d37] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599 * [7bc0e6a] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153 * [671ffd7] - (SEMVER-MAJOR) buffer: use min/max of `validateNumber` (Deokjin Kim) #45796 * [ab1614d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251 * [c1bcdbc] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806 * [649f68f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579 * [9374700] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182 * [1640aeb] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073 * [c2e4b1f] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028 * [3ef38c4] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 * [08af023] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653 * [7eb0ac3] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251 * [a7c129f] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251 * [6f5655a] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #47251 * [f226350] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251 * [d6dae74] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël Zasso) #45579 * [56c4365] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579 * [51ab98c] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579 * [9f84d3e] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579 * [f2318cd] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579 * [16e03e7] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579 * [6473f5e] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352 * [cc18fd9] - (SEMVER-MAJOR) events: refactor to use `validateNumber` (Deokjin Kim) #45770 * [ff92b40] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333 * [2a29df6] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331 * [391dc74] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283 * [ed3604c] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (Marco Ippolito) #45597 * [4b08c4c] - (SEMVER-MAJOR) lib: runtime deprecate punycode (Yagiz Nizipli) #47202 * [88d71dc] - (SEMVER-MAJOR) lib: refactor to use min/max of `validateNumber` (Deokjin Kim) #45772 * [e4d641f] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174 * [0f3e531] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276 * [5b5898a] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841 * [8b51c1a] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790 * [2d0d997] - (SEMVER-MAJOR) process: remove `process.exit()`, `process.exitCode` coercion to integer (Daeyeon Jeong) #43716 * [dc06df3] - (SEMVER-MAJOR) readline: refactor to use `validateNumber` (Deokjin Kim) #45801 * [295b2f3] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251 * [3803b02] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825 * [e8bddac] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705 * [f84de0a] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427 * [a624277] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579 * [dd5c39a] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579 * [63eca7f] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430 * [9e7093f] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322 * [fb91ee4] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579 * [eca6180] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579 * [c03354d] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508 * [c733cc0] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983 * [7ce2232] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251 * [ca4bd30] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251 * [58b06a2] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579 * [027841c] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904 * [3bed5f1] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 * [7c76fdd] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718 * [7efae93] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #47441

Notable Changes: crypto: * (SEMVER-MAJOR) use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 sea: * use JSON configuration and blob content for SEA (Joyee Cheung) #47125 src,process: * (SEMVER-MINOR) add permission model (Rafael Gonzaga) #44004 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MAJOR) runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 Semver-Major Commits: * [9fafb0a] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432 * [1948d37] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599 * [7bc0e6a] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153 * [671ffd7] - (SEMVER-MAJOR) buffer: use min/max of `validateNumber` (Deokjin Kim) #45796 * [ab1614d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251 * [c1bcdbc] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806 * [649f68f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579 * [9374700] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182 * [1640aeb] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073 * [c2e4b1f] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028 * [3ef38c4] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 * [08af023] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653 * [7eb0ac3] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251 * [a7c129f] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251 * [6f5655a] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #47251 * [f226350] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251 * [d6dae74] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël Zasso) #45579 * [56c4365] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579 * [51ab98c] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579 * [9f84d3e] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579 * [f2318cd] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579 * [16e03e7] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579 * [6473f5e] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352 * [cc18fd9] - (SEMVER-MAJOR) events: refactor to use `validateNumber` (Deokjin Kim) #45770 * [ff92b40] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333 * [2a29df6] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331 * [391dc74] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283 * [ed3604c] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (Marco Ippolito) #45597 * [4b08c4c] - (SEMVER-MAJOR) lib: runtime deprecate punycode (Yagiz Nizipli) #47202 * [88d71dc] - (SEMVER-MAJOR) lib: refactor to use min/max of `validateNumber` (Deokjin Kim) #45772 * [e4d641f] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174 * [0f3e531] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276 * [5b5898a] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841 * [8b51c1a] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790 * [2d0d997] - (SEMVER-MAJOR) process: remove `process.exit()`, `process.exitCode` coercion to integer (Daeyeon Jeong) #43716 * [dc06df3] - (SEMVER-MAJOR) readline: refactor to use `validateNumber` (Deokjin Kim) #45801 * [295b2f3] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251 * [3803b02] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825 * [e8bddac] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705 * [f84de0a] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427 * [a624277] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579 * [dd5c39a] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579 * [63eca7f] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430 * [9e7093f] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322 * [fb91ee4] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579 * [eca6180] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579 * [c03354d] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508 * [c733cc0] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983 * [7ce2232] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251 * [ca4bd30] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251 * [58b06a2] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579 * [027841c] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904 * [3bed5f1] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 * [7c76fdd] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718 * [7efae93] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #47441 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Notable Changes: crypto: * (SEMVER-MAJOR) use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 esm: * move hook execution to separate thread (Jacob Smith) #44710 sea: * use JSON configuration and blob content for SEA (Joyee Cheung) #47125 src,process: * (SEMVER-MINOR) add permission model (Rafael Gonzaga) #44004 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MAJOR) runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 Semver-Major Commits: * [9fafb0a] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432 * [1948d37] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599 * [7bc0e6a] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153 * [671ffd7] - (SEMVER-MAJOR) buffer: use min/max of `validateNumber` (Deokjin Kim) #45796 * [ab1614d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251 * [c1bcdbc] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806 * [649f68f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579 * [9374700] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182 * [1640aeb] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073 * [c2e4b1f] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028 * [3ef38c4] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 * [08af023] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653 * [7eb0ac3] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251 * [a7c129f] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251 * [6f5655a] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #47251 * [f226350] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251 * [d6dae74] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël Zasso) #45579 * [56c4365] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579 * [51ab98c] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579 * [9f84d3e] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579 * [f2318cd] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579 * [16e03e7] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579 * [6473f5e] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352 * [cc18fd9] - (SEMVER-MAJOR) events: refactor to use `validateNumber` (Deokjin Kim) #45770 * [ff92b40] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333 * [2a29df6] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331 * [391dc74] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283 * [ed3604c] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (Marco Ippolito) #45597 * [4b08c4c] - (SEMVER-MAJOR) lib: runtime deprecate punycode (Yagiz Nizipli) #47202 * [88d71dc] - (SEMVER-MAJOR) lib: refactor to use min/max of `validateNumber` (Deokjin Kim) #45772 * [e4d641f] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174 * [0f3e531] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276 * [5b5898a] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841 * [8b51c1a] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790 * [2d0d997] - (SEMVER-MAJOR) process: remove `process.exit()`, `process.exitCode` coercion to integer (Daeyeon Jeong) #43716 * [dc06df3] - (SEMVER-MAJOR) readline: refactor to use `validateNumber` (Deokjin Kim) #45801 * [295b2f3] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251 * [3803b02] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825 * [e8bddac] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705 * [f84de0a] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427 * [a624277] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579 * [dd5c39a] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579 * [63eca7f] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430 * [9e7093f] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322 * [fb91ee4] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579 * [eca6180] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579 * [c03354d] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508 * [c733cc0] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983 * [7ce2232] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251 * [ca4bd30] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251 * [58b06a2] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579 * [027841c] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904 * [3bed5f1] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 * [7c76fdd] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718 * [7efae93] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #47441 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Notable Changes: crypto: * (SEMVER-MAJOR) use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 esm: * move hook execution to separate thread (Jacob Smith) #44710 sea: * use JSON configuration and blob content for SEA (Joyee Cheung) #47125 src,process: * (SEMVER-MINOR) add permission model (Rafael Gonzaga) #44004 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MAJOR) runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 Semver-Major Commits: * [9fafb0a] - (SEMVER-MAJOR) async_hooks: deprecate the AsyncResource.bind asyncResource property (James M Snell) #46432 * [1948d37] - (SEMVER-MAJOR) buffer: check INSPECT_MAX_BYTES with validateNumber (Umuoy) #46599 * [7bc0e6a] - (SEMVER-MAJOR) buffer: graduate File from experimental and expose as global (Khafra) #47153 * [671ffd7] - (SEMVER-MAJOR) buffer: use min/max of `validateNumber` (Deokjin Kim) #45796 * [ab1614d] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Michaël Zasso) #47251 * [c1bcdbc] - (SEMVER-MAJOR) build: warn for gcc versions earlier than 10.1 (Richard Lau) #46806 * [649f68f] - (SEMVER-MAJOR) build: reset embedder string to "-node.0" (Yagiz Nizipli) #45579 * [9374700] - (SEMVER-MAJOR) crypto: remove DEFAULT_ENCODING (Tobias Nießen) #47182 * [1640aeb] - (SEMVER-MAJOR) crypto: remove obsolete SSL_OP_* constants (Tobias Nießen) #47073 * [c2e4b1f] - (SEMVER-MAJOR) crypto: remove ALPN_ENABLED (Tobias Nießen) #47028 * [3ef38c4] - (SEMVER-MAJOR) crypto: use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 * [08af023] - (SEMVER-MAJOR) crypto: runtime deprecate replaced rsa-pss keygen parameters (Filip Skokan) #45653 * [7eb0ac3] - (SEMVER-MAJOR) deps: patch V8 to support compilation on win-arm64 (Michaël Zasso) #47251 * [a7c129f] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #47251 * [6f5655a] - (SEMVER-MAJOR) deps: always define V8_EXPORT_PRIVATE as no-op (Michaël Zasso) #47251 * [f226350] - (SEMVER-MAJOR) deps: update V8 to 11.3.244.4 (Michaël Zasso) #47251 * [d6dae74] - (SEMVER-MAJOR) deps: V8: cherry-pick f1c888e7093e (Michaël Zasso) #45579 * [56c4365] - (SEMVER-MAJOR) deps: fix V8 build on Windows with MSVC (Michaël Zasso) #45579 * [51ab98c] - (SEMVER-MAJOR) deps: silence irrelevant V8 warning (Michaël Zasso) #45579 * [9f84d3e] - (SEMVER-MAJOR) deps: V8: fix v8-cppgc.h for MSVC (Jiawen Geng) #45579 * [f2318cd] - (SEMVER-MAJOR) deps: fix V8 build issue with inline methods (Jiawen Geng) #45579 * [16e03e7] - (SEMVER-MAJOR) deps: update V8 to 10.9.194.4 (Yagiz Nizipli) #45579 * [6473f5e] - (SEMVER-MAJOR) doc: update toolchains used for Node.js 20 releases (Richard Lau) #47352 * [cc18fd9] - (SEMVER-MAJOR) events: refactor to use `validateNumber` (Deokjin Kim) #45770 * [ff92b40] - (SEMVER-MAJOR) http: close the connection after sending a body without declared length (Tim Perry) #46333 * [2a29df6] - (SEMVER-MAJOR) http: keep HTTP/1.1 conns alive even if the Connection header is removed (Tim Perry) #46331 * [391dc74] - (SEMVER-MAJOR) http: throw error if options of http.Server is array (Deokjin Kim) #46283 * [ed3604c] - (SEMVER-MAJOR) http: server check Host header, to meet RFC 7230 5.4 requirement (wwwzbwcom) #45597 * [88d71dc] - (SEMVER-MAJOR) lib: refactor to use min/max of `validateNumber` (Deokjin Kim) #45772 * [e4d641f] - (SEMVER-MAJOR) lib: refactor to use validators in http2 (Debadree Chatterjee) #46174 * [0f3e531] - (SEMVER-MAJOR) lib: performance improvement on readline async iterator (Thiago Oliveira Santos) #41276 * [5b5898a] - (SEMVER-MAJOR) lib,src: update exit codes as per todos (Debadree Chatterjee) #45841 * [55321ba] - (SEMVER-MAJOR) net: enable autoSelectFamily by default (Paolo Insogna) #46790 * [2d0d997] - (SEMVER-MAJOR) process: remove `process.exit()`, `process.exitCode` coercion to integer (Daeyeon Jeong) #43716 * [dc06df3] - (SEMVER-MAJOR) readline: refactor to use `validateNumber` (Deokjin Kim) #45801 * [295b2f3] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 115 (Michaël Zasso) #47251 * [3803b02] - (SEMVER-MAJOR) src: share common code paths for SEA and embedder script (Anna Henningsen) #46825 * [e8bddac] - (SEMVER-MAJOR) src: apply ABI-breaking API simplifications (Anna Henningsen) #46705 * [f84de0a] - (SEMVER-MAJOR) src: use uint32_t for process initialization flags enum (Anna Henningsen) #46427 * [a624277] - (SEMVER-MAJOR) src: fix ArrayBuffer::Detach deprecation (Michaël Zasso) #45579 * [dd5c39a] - (SEMVER-MAJOR) src: update NODE_MODULE_VERSION to 112 (Yagiz Nizipli) #45579 * [63eca7f] - (SEMVER-MAJOR) stream: validate readable defaultEncoding (Marco Ippolito) #46430 * [9e7093f] - (SEMVER-MAJOR) stream: validate writable defaultEncoding (Marco Ippolito) #46322 * [fb91ee4] - (SEMVER-MAJOR) test: make trace-gc-flag tests less strict (Yagiz Nizipli) #45579 * [eca6180] - (SEMVER-MAJOR) test: adapt test-v8-stats for V8 update (Michaël Zasso) #45579 * [c03354d] - (SEMVER-MAJOR) test: test case for multiple res.writeHead and res.getHeader (Marco Ippolito) #45508 * [c733cc0] - (SEMVER-MAJOR) test_runner: mark module as stable (Colin Ihrig) #46983 * [7ce2232] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.1 (Michaël Zasso) #47251 * [ca4bd30] - (SEMVER-MAJOR) tools: update V8 gypfiles for 11.0 (Michaël Zasso) #47251 * [58b06a2] - (SEMVER-MAJOR) tools: update V8 gypfiles (Michaël Zasso) #45579 * [027841c] - (SEMVER-MAJOR) url: use private properties for brand check (Yagiz Nizipli) #46904 * [3bed5f1] - (SEMVER-MAJOR) url: runtime-deprecate url.parse() with invalid ports (Rich Trott) #45526 * [7c76fdd] - (SEMVER-MAJOR) util,doc: mark parseArgs() as stable (Colin Ihrig) #46718 * [4b52727] - (SEMVER-MAJOR) wasi: make version non-optional (Michael Dawson) #47391 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #47441 Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

Notably, when `request#options.headers` is an Array, the `Host` header won't be automatically set. In prior versions of node this wasn't of much consequence, but as of [1] its enforced. [1] nodejs/node#45597

* Add node v20 to test matrix * Manually add Host header when passed as Array Notably, when `request#options.headers` is an Array, the `Host` header won't be automatically set. In prior versions of node this wasn't of much consequence, but as of [1] its enforced. [1] nodejs/node#45597

nodejs-github-bot added http Issues or PRs related to the http subsystem. needs-ci PRs that need a full CI run. labels Nov 23, 2022

ronag requested a review from mcollina November 23, 2022 11:40

ronag added the semver-major PRs that contain breaking changes and should be released in the next major version. label Nov 23, 2022

ronag approved these changes Nov 23, 2022

View reviewed changes

ShogunPanda approved these changes Nov 23, 2022

View reviewed changes

lpinca reviewed Nov 23, 2022

View reviewed changes

lib/_http_server.js Outdated Show resolved Hide resolved

anonrig approved these changes Nov 23, 2022

View reviewed changes

mcollina approved these changes Nov 23, 2022

View reviewed changes

mscdex reviewed Nov 23, 2022

View reviewed changes

lib/_http_server.js Outdated Show resolved Hide resolved

mscdex reviewed Nov 23, 2022

View reviewed changes

lib/_http_server.js Show resolved Hide resolved

bnoordhuis reviewed Nov 23, 2022

View reviewed changes

test/parallel/test-http-max-headers-count.js Outdated Show resolved Hide resolved

test/parallel/test-https-max-headers-count.js Outdated Show resolved Hide resolved

lib/_http_server.js Outdated Show resolved Hide resolved

marco-ippolito force-pushed the feat/no-host-request branch 2 times, most recently from 2350f73 to 9f283e1 Compare November 24, 2022 17:42

marco-ippolito requested a review from bnoordhuis November 24, 2022 17:42

wwwzbwcom and others added 10 commits November 25, 2022 15:41

http: server check Host header, to meet RFC 7230 5.4 requirement

6464cd6

http: fix all test after adding Host requirement in server

cb11d61

http: fix more test, include new test and https

14f23b8

https: fix test-https-host-headers

3b12797

http: remove extra comment

ca6387c

fix: typo

1945900

Co-authored-by: Luigi Pinca <luigipinca@gmail.com>

fix: removed unnecessary http11 check

fdf9822

Co-authored-by: mscdex <mscdex@users.noreply.github.com>

fix: removed variable

bf49f88

http: added test and fixed behaviour

e3983ed

http: updated tests and close connection

74650da

marco-ippolito deleted the feat/no-host-request branch November 28, 2022 18:23

This was referenced Nov 29, 2022

CI Reliability 2022-11-29 nodejs/reliability#443

Open

CI Reliability 2022-11-30 nodejs/reliability#444

Open

climba03003 mentioned this pull request Jan 26, 2023

test: add host header for net connection fastify/fastify#4536

Merged

4 tasks

RafaelGSS mentioned this pull request Apr 3, 2023

2023-04-18, Version 20.0.0 (Current) #47381

Merged

marco-ippolito mentioned this pull request Apr 27, 2023

http: prevent writing to the body when not allowed by HTTP spec #47732

Merged

marco-ippolito mentioned this pull request May 15, 2024

Commit queue overwrites commit author #52967

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

http: server check Host header in request, to meet RFC 7230 5.4 requirement #45597

http: server check Host header in request, to meet RFC 7230 5.4 requirement #45597

marco-ippolito commented Nov 23, 2022

nodejs-github-bot commented Nov 23, 2022

ShogunPanda left a comment

nodejs-github-bot commented Nov 23, 2022

mcollina left a comment

bnoordhuis left a comment

bnoordhuis commented Nov 24, 2022

nodejs-github-bot commented Nov 25, 2022

nodejs-github-bot commented Nov 25, 2022

ShogunPanda commented Nov 28, 2022 •

edited

aduh95 commented Nov 28, 2022 •

edited

ShogunPanda commented Nov 28, 2022 •

edited

http: server check Host header in request, to meet RFC 7230 5.4 requirement #45597

http: server check Host header in request, to meet RFC 7230 5.4 requirement #45597

Conversation

marco-ippolito commented Nov 23, 2022

nodejs-github-bot commented Nov 23, 2022

ShogunPanda left a comment

Choose a reason for hiding this comment

nodejs-github-bot commented Nov 23, 2022

mcollina left a comment

Choose a reason for hiding this comment

bnoordhuis left a comment

Choose a reason for hiding this comment

bnoordhuis commented Nov 24, 2022

nodejs-github-bot commented Nov 25, 2022

nodejs-github-bot commented Nov 25, 2022

ShogunPanda commented Nov 28, 2022 • edited

aduh95 commented Nov 28, 2022 • edited

ShogunPanda commented Nov 28, 2022 • edited

ShogunPanda commented Nov 28, 2022 •

edited

aduh95 commented Nov 28, 2022 •

edited

ShogunPanda commented Nov 28, 2022 •

edited