jiangcuo/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2025-04-28 13:40:37 +00:00
Code Issues Actions 20 Packages Projects Releases Wiki Activity

http: do not allow OBS fold in headers by default

Browse Source 
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Fixes: https://hackerone.com/reports/2237099
PR-URL: https://github.com/nodejs-private/node-private/pull/556
CVE-ID: CVE-2024-27982
This commit is contained in:
Paolo Insogna 2024-03-14 16:45:42 +01:00 committed by RafaelGSS
parent b25b5aca96
commit 04e16463d1
7 changed files with 299 additions and 283 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
deps/llhttp/.gitignore vendored
View File

@ -1 +0,0 @@
libllhttp.pc

2
deps/llhttp/CMakeLists.txt vendored
View File

@ -1,7 +1,7 @@
cmake_minimum_required(VERSION 3.5.1)
cmake_policy(SET CMP0069 NEW)
project(llhttp VERSION 9.2.0)
project(llhttp VERSION 9.2.1)
include(GNUInstallDirs)
set(CMAKE_C_STANDARD 99)

4
deps/llhttp/README.md vendored
View File

@ -397,7 +397,7 @@ With this flag this check is disabled.
Make sure you have [Node.js](https://nodejs.org/), npm and npx installed. Then under project directory run:
```sh
npm install
npm ci
make
```
@ -451,7 +451,7 @@ _Note that using the git repo directly (e.g., via a git repo url and tag) will n
1. Ensure that `Clang` and `make` are in your system path.
2. Using Git Bash, clone the repo to your preferred location.
3. Cd into the cloned directory and run `npm install`
3. Cd into the cloned directory and run `npm ci`
5. Run `make`
6. Your `repo/build` directory should now have `libllhttp.a` and `libllhttp.so` static and dynamic libraries.
7. When building your executable, you can link to these libraries. Make sure to set the build folder as an include path when building so you can reference the declarations in `repo/build/llhttp.h`.

2
deps/llhttp/include/llhttp.h vendored
View File

@ -4,7 +4,7 @@
#define LLHTTP_VERSION_MAJOR 9
#define LLHTTP_VERSION_MINOR 2
#define LLHTTP_VERSION_PATCH 0
#define LLHTTP_VERSION_PATCH 1
#ifndef INCLUDE_LLHTTP_ITSELF_H_
#define INCLUDE_LLHTTP_ITSELF_H_

565
deps/llhttp/src/llhttp.c vendored
View File

File diff suppressed because it is too large Load Diff

3
test/parallel/test-http-multi-line-headers.js
View File

@ -46,7 +46,8 @@ const server = net.createServer(function(conn) {
server.listen(0, common.mustCall(function() {
http.get({
host: '127.0.0.1',
port: this.address().port
port: this.address().port,
insecureHTTPParser: true
}, common.mustCall(function(res) {
assert.strictEqual(res.headers['content-type'],
'text/plain; x-unix-mode=0600; name="hello.txt"');

5
test/parallel/test-http-transfer-encoding-smuggling.js
View File

@ -71,10 +71,7 @@ const net = require('net');
'',
].join('\r\n');
const server = http.createServer(common.mustCall((request, response) => {
assert.notStrictEqual(request.url, '/admin');
response.end('hello world');
}), 1);
const server = http.createServer(common.mustNotCall());
server.listen(0, common.mustSucceed(() => {
const client = net.connect(server.address().port, 'localhost');