Skip to content

Commit 30098ca

Browse files
ShogunPandaAdamMajer
ShogunPanda
authored and
AdamMajer
committed
fix: Do not allow OBS fold in headers by default. (nodejs#350)
1 parent 9db176e commit 30098ca

8 files changed

Lines changed: 80 additions & 30 deletions

File tree

‎package.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
{
22
"name": "llhttp",
33
"version": "2.1.6-suse",
4-
"version": "6.0.11",
54
"description": "HTTP parser in LLVM IR",
65
"main": "lib/llhttp.js",
76
"types": "lib/llhttp.d.ts",

‎src/llhttp/http.ts‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -599,11 +599,14 @@ export class HTTP {
599599
'Missing expected LF after header value'));
600600

601601
n('header_value_lws')
602-
.peek([ ' ', '\t' ],
603-
this.load('header_state', {
604-
[HEADER_STATE.TRANSFER_ENCODING_CHUNKED]:
605-
this.resetHeaderState(span.headerValue.start(n('header_value_start'))),
606-
}, span.headerValue.start(n('header_value_start'))))
602+
.peek(
603+
[ ' ', '\t' ],
604+
this.testFlags(FLAGS.LENIENT, {
605+
1: this.load('header_state', {
606+
[HEADER_STATE.TRANSFER_ENCODING_CHUNKED]:
607+
this.resetHeaderState(span.headerValue.start(n('header_value_start'))),
608+
}, span.headerValue.start(n('header_value_start'))),
609+
}, p.error(ERROR.INVALID_HEADER_TOKEN, 'Unexpected whitespace after header value')))
607610
.otherwise(this.setHeaderFlags('header_field_start'));
608611

609612
const checkTrailing = this.testFlags(FLAGS.TRAILING, {

‎test/request/connection.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -263,7 +263,7 @@ off=75 message complete
263263

264264
### Multiple tokens with folding
265265

266-
<!-- meta={"type": "request"} -->
266+
<!-- meta={"type": "request-lenient"} -->
267267
```http
268268
GET /demo HTTP/1.1
269269
Host: example.com
@@ -296,7 +296,7 @@ off=178 len=18 span[header_field]="Sec-WebSocket-Key1"
296296
off=198 len=20 span[header_value]="4 @1 46546xW%0l 1 5"
297297
off=220 len=6 span[header_field]="Origin"
298298
off=228 len=18 span[header_value]="http://example.com"
299-
off=250 headers complete method=1 v=1/1 flags=15 content_length=0
299+
off=250 headers complete method=1 v=1/1 flags=115 content_length=0
300300
off=250 message complete
301301
off=250 error code=22 reason="Pause on CONNECT/Upgrade"
302302
```
@@ -326,7 +326,7 @@ off=75 error code=22 reason="Pause on CONNECT/Upgrade"
326326

327327
### Multiple tokens with folding, LWS, and CRLF
328328

329-
<!-- meta={"type": "request"} -->
329+
<!-- meta={"type": "request-lenient"} -->
330330
```http
331331
GET /demo HTTP/1.1
332332
Connection: keep-alive, \r\n upgrade
@@ -343,7 +343,7 @@ off=32 len=12 span[header_value]="keep-alive, "
343343
off=46 len=8 span[header_value]=" upgrade"
344344
off=56 len=7 span[header_field]="Upgrade"
345345
off=65 len=9 span[header_value]="WebSocket"
346-
off=78 headers complete method=1 v=1/1 flags=15 content_length=0
346+
off=78 headers complete method=1 v=1/1 flags=115 content_length=0
347347
off=78 message complete
348348
off=78 error code=22 reason="Pause on CONNECT/Upgrade"
349349
```

‎test/request/invalid.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,3 +249,64 @@ off=33 len=5 span[header_field]="Dummy"
249249
off=40 len=1 span[header_value]="x"
250250
off=41 error code=10 reason="Invalid header value char"
251251
```
252+
253+
### Spaces before headers
254+
255+
<!-- meta={ "type": "request" } -->
256+
257+
```http
258+
POST /hello HTTP/1.1
259+
Host: localhost
260+
Foo: bar
261+
Content-Length: 38
262+
263+
GET /bye HTTP/1.1
264+
Host: localhost
265+
266+
267+
```
268+
269+
```log
270+
off=0 message begin
271+
off=5 len=6 span[url]="/hello"
272+
off=22 len=4 span[header_field]="Host"
273+
off=28 len=9 span[header_value]="localhost"
274+
off=39 len=3 span[header_field]="Foo"
275+
off=44 len=3 span[header_value]="bar"
276+
off=49 error code=10 reason="Unexpected whitespace after header value"
277+
```
278+
279+
### Spaces before headers (lenient)
280+
281+
<!-- meta={ "type": "request-lenient" } -->
282+
283+
```http
284+
POST /hello HTTP/1.1
285+
Host: localhost
286+
Foo: bar
287+
Content-Length: 38
288+
289+
GET /bye HTTP/1.1
290+
Host: localhost
291+
292+
293+
```
294+
295+
```log
296+
off=0 message begin
297+
off=5 len=6 span[url]="/hello"
298+
off=22 len=4 span[header_field]="Host"
299+
off=28 len=9 span[header_value]="localhost"
300+
off=39 len=3 span[header_field]="Foo"
301+
off=44 len=3 span[header_value]="bar"
302+
off=49 len=19 span[header_value]=" Content-Length: 38"
303+
off=72 headers complete method=3 v=1/1 flags=100 content_length=0
304+
off=72 message complete
305+
off=72 message begin
306+
off=76 len=4 span[url]="/bye"
307+
off=91 len=4 span[header_field]="Host"
308+
off=97 len=9 span[header_value]="localhost"
309+
off=110 headers complete method=1 v=1/1 flags=100 content_length=0
310+
off=110 message complete
311+
```
312+

‎test/request/sample.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -369,7 +369,7 @@ off=61 message complete
369369

370370
See nodejs/test/parallel/test-http-headers-obstext.js
371371

372-
<!-- meta={"type": "request"} -->
372+
<!-- meta={"type": "request-lenient"} -->
373373
```http
374374
GET / HTTP/1.1
375375
X-SSL-Nonsense: -----BEGIN CERTIFICATE-----
@@ -444,7 +444,7 @@ off=1873 len=65 span[header_value]="\twTC6o2xq5y0qZ03JonF7OJspEd3I5zKY3E+ov7/ZhW
444444
off=1940 len=65 span[header_value]="\tYhixw1aKEPzNjNowuIseVogKOLXxWI5vAi5HgXdS0/ES5gDGsABo4fqovUKlgop3"
445445
off=2007 len=5 span[header_value]="\tRA=="
446446
off=2014 len=26 span[header_value]="\t-----END CERTIFICATE-----"
447-
off=2044 headers complete method=1 v=1/1 flags=0 content_length=0
447+
off=2044 headers complete method=1 v=1/1 flags=100 content_length=0
448448
off=2044 message complete
449449
```
450450

‎test/request/transfer-encoding.md‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -536,7 +536,5 @@ off=0 message begin
536536
off=4 len=4 span[url]="/url"
537537
off=19 len=17 span[header_field]="Transfer-Encoding"
538538
off=38 len=7 span[header_value]="chunked"
539-
off=47 len=5 span[header_value]=" abc"
540-
off=56 headers complete method=4 v=1/1 flags=200 content_length=0
541-
off=56 error code=15 reason="Request has invalid `Transfer-Encoding`"
539+
off=47 error code=10 reason="Unexpected whitespace after header value"
542540
```

‎test/response/transfer-encoding.md‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ off=78 len=1 span[body]=lf
118118

119119
## Invalid OBS fold after chunked value
120120

121-
<!-- meta={"type": "response" } -->
121+
<!-- meta={"type": "response"} -->
122122
```http
123123
HTTP/1.1 200 OK
124124
Transfer-Encoding: chunked
@@ -136,18 +136,6 @@ off=0 message begin
136136
off=13 len=2 span[status]="OK"
137137
off=17 len=17 span[header_field]="Transfer-Encoding"
138138
off=36 len=7 span[header_value]="chunked"
139-
off=45 len=5 span[header_value]=" abc"
140-
off=54 headers complete status=200 v=1/1 flags=200 content_length=0
141-
off=54 len=1 span[body]="5"
142-
off=55 len=1 span[body]=cr
143-
off=56 len=1 span[body]=lf
144-
off=57 len=5 span[body]="World"
145-
off=62 len=1 span[body]=cr
146-
off=63 len=1 span[body]=lf
147-
off=64 len=1 span[body]="0"
148-
off=65 len=1 span[body]=cr
149-
off=66 len=1 span[body]=lf
150-
off=67 len=1 span[body]=cr
151-
off=68 len=1 span[body]=lf
139+
off=45 error code=10 reason="Unexpected whitespace after header value"
152140
```
153141

‎tsconfig.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@
77
"outDir": "./lib",
88
"declaration": true,
99
"pretty": true,
10-
"sourceMap": true
10+
"sourceMap": true,
11+
"skipLibCheck": true
1112
},
1213
"include": [
1314
"src/**/*.ts"

0 commit comments

Comments
 (0)