Commit 8a8f212
http2: validate non-link headers in writeEarlyHints
Validate header names and values for non-link hints passed to
writeEarlyHints() in the HTTP/2 compat layer using assertValidHeader()
and checkIsHttpToken(), consistent with the HTTP/1.1 validation added
in #61897.
Previously, hints were forwarded into the headers object without any
validation, allowing invalid characters in header names/values to
surface as opaque errors deeper in the HTTP/2 stack.
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #62017
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent ec86c69 commit 8a8f212
2 files changed
Lines changed: 65 additions & 1 deletion
File tree
- lib/internal/http2
- test/parallel
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -921,7 +921,11 @@ class Http2ServerResponse extends Stream { | |||
| 921 | 921 | ||
| 922 | 922 | for (const key of ObjectKeys(hints)) { | |
| 923 | 923 | if (key !== 'link') { | |
| 924 | - headers[key] = hints[key]; | ||
| 924 | + const name = key.trim().toLowerCase(); | ||
| 925 | + assertValidHeader(name, hints[key]); | ||
| 926 | + if (!checkIsHttpToken(name)) | ||
| 927 | + throw new ERR_INVALID_HTTP_TOKEN('Header name', name); | ||
| 928 | + headers[name] = hints[key]; | ||
| 925 | 929 | } | |
| 926 | 930 | } | |
| 927 | 931 | ||
Lines changed: 60 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,60 @@ | |||
| 1 | + 'use strict'; | ||
| 2 | + | ||
| 3 | + const common = require('../common'); | ||
| 4 | + if (!common.hasCrypto) common.skip('missing crypto'); | ||
| 5 | + | ||
| 6 | + const assert = require('node:assert'); | ||
| 7 | + const http2 = require('node:http2'); | ||
| 8 | + const debug = require('node:util').debuglog('test'); | ||
| 9 | + | ||
| 10 | + const testResBody = 'response content'; | ||
| 11 | + | ||
| 12 | + { | ||
| 13 | + const server = http2.createServer(); | ||
| 14 | + | ||
| 15 | + server.on('request', common.mustCall((req, res) => { | ||
| 16 | + debug('Server sending early hints...'); | ||
| 17 | + | ||
| 18 | + assert.throws(() => { | ||
| 19 | + res.writeEarlyHints({ | ||
| 20 | + 'link': '</styles.css>; rel=preload; as=style', | ||
| 21 | + 'x\rbad': 'value', | ||
| 22 | + }); | ||
| 23 | + }, (err) => err.code === 'ERR_INVALID_HTTP_TOKEN'); | ||
| 24 | + | ||
| 25 | + assert.throws(() => { | ||
| 26 | + res.writeEarlyHints({ | ||
| 27 | + 'link': '</styles.css>; rel=preload; as=style', | ||
| 28 | + 'x-custom': undefined, | ||
| 29 | + }); | ||
| 30 | + }, (err) => err.code === 'ERR_HTTP2_INVALID_HEADER_VALUE'); | ||
| 31 | + | ||
| 32 | + debug('Server sending full response...'); | ||
| 33 | + res.end(testResBody); | ||
| 34 | + })); | ||
| 35 | + | ||
| 36 | + server.listen(0); | ||
| 37 | + | ||
| 38 | + server.on('listening', common.mustCall(() => { | ||
| 39 | + const client = http2.connect(`http://localhost:${server.address().port}`); | ||
| 40 | + const req = client.request(); | ||
| 41 | + | ||
| 42 | + debug('Client sending request...'); | ||
| 43 | + | ||
| 44 | + req.on('headers', common.mustNotCall()); | ||
| 45 | + | ||
| 46 | + req.on('response', common.mustCall((headers) => { | ||
| 47 | + assert.strictEqual(headers[':status'], 200); | ||
| 48 | + })); | ||
| 49 | + | ||
| 50 | + let data = ''; | ||
| 51 | + req.on('data', common.mustCallAtLeast((d) => data += d)); | ||
| 52 | + | ||
| 53 | + req.on('end', common.mustCall(() => { | ||
| 54 | + debug('Got full response.'); | ||
| 55 | + assert.strictEqual(data, testResBody); | ||
| 56 | + client.close(); | ||
| 57 | + server.close(); | ||
| 58 | + })); | ||
| 59 | + })); | ||
| 60 | + } | ||
0 commit comments