mirror of
https://github.com/nodejs/node.git
synced 2025-05-07 12:03:30 +00:00

CVE-2018-12122 An attacker can send a char/s within headers and exahust the resources (file descriptors) of a system even with a tight max header length protection. This PR destroys a socket if it has not received the headers in 40s. PR-URL: https://github.com/nodejs-private/node-private/pull/144 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com>
64 lines
1.5 KiB
JavaScript
64 lines
1.5 KiB
JavaScript
'use strict';
|
|
|
|
const common = require('../common');
|
|
const { readKey } = require('../common/fixtures');
|
|
|
|
if (!common.hasCrypto)
|
|
common.skip('missing crypto');
|
|
|
|
const assert = require('assert');
|
|
const { createServer } = require('https');
|
|
const { connect } = require('tls');
|
|
const { finished } = require('stream');
|
|
|
|
// This test validates that the 'timeout' event fires
|
|
// after server.headersTimeout.
|
|
|
|
const headers =
|
|
'GET / HTTP/1.1\r\n' +
|
|
'Host: localhost\r\n' +
|
|
'Agent: node\r\n';
|
|
|
|
const server = createServer({
|
|
key: readKey('agent1-key.pem'),
|
|
cert: readKey('agent1-cert.pem'),
|
|
ca: readKey('ca1-cert.pem'),
|
|
}, common.mustNotCall());
|
|
|
|
let sendCharEvery = 1000;
|
|
|
|
// 40 seconds is the default
|
|
assert.strictEqual(server.headersTimeout, 40 * 1000);
|
|
|
|
// pass a REAL env variable to shortening up the default
|
|
// value which is 40s otherwise
|
|
// this is useful for manual testing
|
|
if (!process.env.REAL) {
|
|
sendCharEvery = common.platformTimeout(10);
|
|
server.headersTimeout = 2 * sendCharEvery;
|
|
}
|
|
|
|
server.once('timeout', common.mustCall((socket) => {
|
|
socket.destroy();
|
|
}));
|
|
|
|
server.listen(0, common.mustCall(() => {
|
|
const client = connect({
|
|
port: server.address().port,
|
|
rejectUnauthorized: false
|
|
});
|
|
client.write(headers);
|
|
client.write('X-CRASH: ');
|
|
|
|
const interval = setInterval(() => {
|
|
client.write('a');
|
|
}, sendCharEvery);
|
|
|
|
client.resume();
|
|
|
|
finished(client, common.mustCall((err) => {
|
|
clearInterval(interval);
|
|
server.close();
|
|
}));
|
|
}));
|