Skip to content

Commit b961d9f

Browse files
bennofsBridgeAR
authored andcommitted
http: disallow two-byte characters in URL path
This commit changes node's handling of two-byte characters in the path component of an http URL. Previously, node would just strip the higher byte when generating the request. So this code: ``` http.request({host: "example.com", port: "80", "/N"}) ``` would request `http://example.com/.` (`.` is the character for the byte `0x2e`). This is not useful and can in some cases lead to filter evasion. With this change, the code generates `ERR_UNESCAPED_CHARACTERS`, just like space and control characters already did. PR-URL: #16237 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Anatoli Papirovski <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]> Reviewed-By: Timothy Gu <[email protected]>
1 parent ac25cee commit b961d9f

File tree

2 files changed

+14
-34
lines changed

2 files changed

+14
-34
lines changed

lib/_http_client.js

Lines changed: 2 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -41,33 +41,7 @@ const { outHeadersKey } = require('internal/http');
4141
const { nextTick } = require('internal/process/next_tick');
4242
const errors = require('internal/errors');
4343

44-
// The actual list of disallowed characters in regexp form is more like:
45-
// /[^A-Za-z0-9\-._~!$&'()*+,;=/:@]/
46-
// with an additional rule for ignoring percentage-escaped characters, but
47-
// that's a) hard to capture in a regular expression that performs well, and
48-
// b) possibly too restrictive for real-world usage. So instead we restrict the
49-
// filter to just control characters and spaces.
50-
//
51-
// This function is used in the case of small paths, where manual character code
52-
// checks can greatly outperform the equivalent regexp (tested in V8 5.4).
53-
function isInvalidPath(s) {
54-
var i = 0;
55-
if (s.charCodeAt(0) <= 32) return true;
56-
if (++i >= s.length) return false;
57-
if (s.charCodeAt(1) <= 32) return true;
58-
if (++i >= s.length) return false;
59-
if (s.charCodeAt(2) <= 32) return true;
60-
if (++i >= s.length) return false;
61-
if (s.charCodeAt(3) <= 32) return true;
62-
if (++i >= s.length) return false;
63-
if (s.charCodeAt(4) <= 32) return true;
64-
if (++i >= s.length) return false;
65-
if (s.charCodeAt(5) <= 32) return true;
66-
++i;
67-
for (; i < s.length; ++i)
68-
if (s.charCodeAt(i) <= 32) return true;
69-
return false;
70-
}
44+
const INVALID_PATH_REGEX = /[^\u0021-\u00ff]/;
7145

7246
function validateHost(host, name) {
7347
if (host != null && typeof host !== 'string') {
@@ -117,13 +91,7 @@ function ClientRequest(options, cb) {
11791
var path;
11892
if (options.path) {
11993
path = String(options.path);
120-
var invalidPath;
121-
if (path.length <= 39) { // Determined experimentally in V8 5.4
122-
invalidPath = isInvalidPath(path);
123-
} else {
124-
invalidPath = /[\u0000-\u0020]/.test(path);
125-
}
126-
if (invalidPath)
94+
if (INVALID_PATH_REGEX.test(path))
12795
throw new errors.TypeError('ERR_UNESCAPED_CHARACTERS', 'Request path');
12896
}
12997

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
'use strict';
2+
const common = require('../common');
3+
const http = require('http');
4+
5+
common.expectsError(() => {
6+
http.request({
7+
path: '/thisisinvalid\uffe2'
8+
}).end();
9+
}, {
10+
code: 'ERR_UNESCAPED_CHARACTERS',
11+
type: TypeError
12+
});

0 commit comments

Comments
 (0)