mirror of
https://github.com/nodejs/node.git
synced 2025-05-01 17:03:34 +00:00
df08d527c2
This commits introduces a new http.Server option called requestTimeout with a default value in milliseconds of 0. If requestTimeout is set to a positive value, the server will start a new timer set to expire in requestTimeout milliseconds when a new connection is established. The timer is also set again if new requests after the first are received on the socket (this handles pipelining and keep-alive cases). The timer is cancelled when: 1. the request body is completely received by the server. 2. the response is completed. This handles the case where the application responds to the client without consuming the request body. 3. the connection is upgraded, like in the WebSocket case. If the timer expires, then the server responds with status code 408 and closes the connection. CVE-2020-8251 PR-URL: https://github.com/nodejs-private/node-private/pull/208 Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Mary Marchini <oss@mmarchini.me> Co-Authored-By: Paolo Insogna <paolo@cowtech.it> Co-Authored-By: Robert Nagy <ronagy@icloud.com>
63 lines
1.6 KiB
JavaScript
63 lines
1.6 KiB
JavaScript
'use strict';
|
|
|
|
const common = require('../common');
|
|
const assert = require('assert');
|
|
const { createServer } = require('http');
|
|
const { connect } = require('net');
|
|
|
|
// This test validates that the server returns 408
|
|
// after server.requestTimeout if the client
|
|
// pauses before start sending the body.
|
|
|
|
const server = createServer(common.mustCall((req, res) => {
|
|
let body = '';
|
|
req.setEncoding('utf-8');
|
|
|
|
req.on('data', (chunk) => {
|
|
body += chunk;
|
|
});
|
|
|
|
req.on('end', () => {
|
|
res.writeHead(200, { 'Content-Type': 'text/plain' });
|
|
res.write(body);
|
|
res.end();
|
|
});
|
|
}));
|
|
|
|
// 0 seconds is the default
|
|
assert.strictEqual(server.requestTimeout, 0);
|
|
const requestTimeout = common.platformTimeout(1000);
|
|
server.requestTimeout = requestTimeout;
|
|
assert.strictEqual(server.requestTimeout, requestTimeout);
|
|
|
|
server.listen(0, common.mustCall(() => {
|
|
const client = connect(server.address().port);
|
|
let response = '';
|
|
|
|
client.on('data', common.mustCall((chunk) => {
|
|
response += chunk.toString('utf-8');
|
|
}));
|
|
|
|
client.resume();
|
|
client.write('POST / HTTP/1.1\r\n');
|
|
client.write('Content-Length: 20\r\n');
|
|
client.write('Connection: close\r\n');
|
|
client.write('\r\n');
|
|
|
|
setTimeout(() => {
|
|
client.write('12345678901234567890\r\n\r\n');
|
|
}, common.platformTimeout(2000)).unref();
|
|
|
|
const errOrEnd = common.mustCall(function(err) {
|
|
console.log(err);
|
|
assert.strictEqual(
|
|
response,
|
|
'HTTP/1.1 408 Request Timeout\r\nConnection: close\r\n\r\n'
|
|
);
|
|
server.close();
|
|
});
|
|
|
|
client.on('end', errOrEnd);
|
|
client.on('error', errOrEnd);
|
|
}));
|