archive/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2025-08-16 14:18:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

http: disable chunked encoding when OBS fold is used

Browse source 
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Vladimir de Turckheim <vlad2t@hotmail.com>
PR-URL: #341
CVE-ID: CVE-2022-32213, CVE-2022-32215, CVE-2022-35256
This commit is contained in:
Paolo Insogna 2022-09-19 14:37:21 +02:00 • committed by RafaelGSS
parent 5cc36c39d2
commit 2e92e5b71d
6 changed files with 379 additions and 287 deletions
Download patch file Download diff file Expand all files Collapse all files

9
test/parallel/test-http-header-overflow.js
View file

@ -6,13 +6,11 @@ const assert = require('assert');
const { createServer, maxHeaderSize } = require('http');
const { createConnection } = require('net');
const { getOptionValue } = require('internal/options');
const CRLF = '\r\n';
const DUMMY_HEADER_NAME = 'Cookie: ';
const DUMMY_HEADER_VALUE = 'a'.repeat(
// Plus one is to make it 1 byte too big
maxHeaderSize - DUMMY_HEADER_NAME.length - (2 * CRLF.length) + 1
maxHeaderSize - DUMMY_HEADER_NAME.length + 2
);
const PAYLOAD_GET = 'GET /blah HTTP/1.1';
const PAYLOAD = PAYLOAD_GET + CRLF +
@ -21,14 +19,11 @@ const PAYLOAD = PAYLOAD_GET + CRLF +
const server = createServer();
server.on('connection', mustCall((socket) => {
// Legacy parser gives sligthly different response.
// This discripancy is not fixed on purpose.
const legacy = getOptionValue('--http-parser') === 'legacy';
socket.on('error', expectsError({
name: 'Error',
message: 'Parse Error: Header overflow',
code: 'HPE_HEADER_OVERFLOW',
bytesParsed: maxHeaderSize + PAYLOAD_GET.length - (legacy ? -1 : 0),
bytesParsed: maxHeaderSize + PAYLOAD_GET.length + (CRLF.length * 2) + 1,
rawPacket: Buffer.from(PAYLOAD)
}));
}));