mirror of
https://github.com/nodejs/node.git
synced 2025-05-05 17:10:40 +00:00
4f62acd9c5
Unsanitized paths containing line feed characters can be used for header injection and request splitting so reject them with an exception. There seems to be no reasonable use case for allowing control characters (characters <= 31) while there are several scenarios where they can be used to exploit software bugs so reject control characters altogether. PR-URL: https://github.com/nodejs/node/pull/8923 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Evan Lucas <evanlucas@me.com> Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: not-an-aardvark <not-an-aardvark@users.noreply.github.com>
15 lines
358 B
JavaScript
15 lines
358 B
JavaScript
'use strict';
|
|
const common = require('../common');
|
|
const assert = require('assert');
|
|
const http = require('http');
|
|
|
|
function* bad() {
|
|
for (let i = 0; i <= 32; i += 1)
|
|
yield 'bad' + String.fromCharCode(i) + 'path';
|
|
}
|
|
|
|
for (const path of bad()) {
|
|
assert.throws(() => http.get({ path }, common.fail),
|
|
/contains unescaped characters/);
|
|
}
|