mirror of
https://github.com/nodejs/node.git
synced 2025-05-07 15:35:41 +00:00
ee618a7ab2
CVE-2018-12122 An attacker can send a char/s within headers and exahust the resources (file descriptors) of a system even with a tight max header length protection. This PR destroys a socket if it has not received the headers in 40s. PR-URL: https://github.com/nodejs-private/node-private/pull/144 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com>
51 lines
1.2 KiB
JavaScript
51 lines
1.2 KiB
JavaScript
'use strict';
|
|
|
|
const common = require('../common');
|
|
const assert = require('assert');
|
|
const { createServer } = require('http');
|
|
const { connect } = require('net');
|
|
const { finished } = require('stream');
|
|
|
|
// This test validates that the 'timeout' event fires
|
|
// after server.headersTimeout.
|
|
|
|
const headers =
|
|
'GET / HTTP/1.1\r\n' +
|
|
'Host: localhost\r\n' +
|
|
'Agent: node\r\n';
|
|
|
|
const server = createServer(common.mustNotCall());
|
|
let sendCharEvery = 1000;
|
|
|
|
// 40 seconds is the default
|
|
assert.strictEqual(server.headersTimeout, 40 * 1000);
|
|
|
|
// Pass a REAL env variable to shortening up the default
|
|
// value which is 40s otherwise this is useful for manual
|
|
// testing
|
|
if (!process.env.REAL) {
|
|
sendCharEvery = common.platformTimeout(10);
|
|
server.headersTimeout = 2 * sendCharEvery;
|
|
}
|
|
|
|
server.once('timeout', common.mustCall((socket) => {
|
|
socket.destroy();
|
|
}));
|
|
|
|
server.listen(0, common.mustCall(() => {
|
|
const client = connect(server.address().port);
|
|
client.write(headers);
|
|
client.write('X-CRASH: ');
|
|
|
|
const interval = setInterval(() => {
|
|
client.write('a');
|
|
}, sendCharEvery);
|
|
|
|
client.resume();
|
|
|
|
finished(client, common.mustCall((err) => {
|
|
clearInterval(interval);
|
|
server.close();
|
|
}));
|
|
}));
|