http: server check Host header, to meet RFC 7230 5.4 requirement

PR-URL: #45597Fixes: #39033
Co-authored-by: Luigi Pinca <luigipinca@gmail.com>
Co-authored-by: mscdex <mscdex@users.noreply.github.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Author: 3 people

doc/api/http.md

@@ -3185,6 +3185,10 @@ changes:
 *`uniqueHeaders` {Array} A list of response headers that should be sent only
  once. If the header's value is an array, the items will be joined
  using `; `.
+*`requireHostHeader` {boolean} It forces the server to respond with
+ a 400 (Bad Request) status code to any HTTP/1.1 request message
+ that lacks a Host header (as mandated by the specification).
+**Default:**`true`.
 
 *`requestListener` {Function}
 

lib/_http_server.js

@@ -473,6 +473,14 @@ function storeHTTPOptions(options) {
 }else{
 this.connectionsCheckingInterval=30_000;// 30 seconds
 }
+
+constrequireHostHeader=options.requireHostHeader;
+if(requireHostHeader!==undefined){
+validateBoolean(requireHostHeader,'options.requireHostHeader');
+this.requireHostHeader=requireHostHeader;
+}else{
+this.requireHostHeader=true;
+}
 }
 
 functionsetupConnectionsTracking(server){
@@ -1022,7 +1030,18 @@ function parserOnIncoming(server, socket, state, req, keepAlive) {
 
 lethandled=false;
 
+
 if(req.httpVersionMajor===1&&req.httpVersionMinor===1){
+
+// From RFC 7230 5.4 https://datatracker.ietf.org/doc/html/rfc7230#section-5.4
+// A server MUST respond with a 400 (Bad Request) status code to any
+// HTTP/1.1 request message that lacks a Host header field
+if(server.requireHostHeader&&req.headers.host===undefined){
+res.writeHead(400,['Connection','close']);
+res.end();
+return0;
+}
+
 constisRequestsLimitSet=(
 typeofserver.maxRequestsPerSocket==='number'&&
 server.maxRequestsPerSocket>0
@@ -1045,7 +1064,6 @@ function parserOnIncoming(server, socket, state, req, keepAlive) {
 
 if(RegExpPrototypeExec(continueExpression,req.headers.expect)!==null){
 res._expect_continue=true;
-
 if(server.listenerCount('checkContinue')>0){
 server.emit('checkContinue',req,res);
 }else{

lib/http.js

@@ -52,6 +52,7 @@ let maxHeaderSize;
  * ServerResponse?: ServerResponse;
  * insecureHTTPParser?: boolean;
  * maxHeaderSize?: number;
+ * requireHostHeader?: boolean
  * }} [opts]
  * @param {Function} [requestListener]
  * @returns {Server}

test/parallel/test-http-chunked-304.js

@@ -47,7 +47,7 @@ function test(statusCode) {
 constconn=net.createConnection(
 server.address().port,
 common.mustCall(()=>{
-conn.write('GET / HTTP/1.1\r\n\r\n');
+conn.write('GET / HTTP/1.1\r\nHost: example.com\r\n\r\n');
 
 letresp='';
 conn.setEncoding('utf8');

test/parallel/test-http-client-headers-array.js

@@ -10,7 +10,8 @@ function execute(options) {
 constexpectHeaders={
 'x-foo': 'boom',
 'cookie': 'a=1; b=2; c=3',
-'connection': 'keep-alive'
+'connection': 'keep-alive',
+'host': 'example.com',
 };
 
 // no Host header when you set headers an array
@@ -43,13 +44,20 @@ function execute(options) {
 // Should be the same except for implicit Host header on the first two
 execute({headers: {'x-foo': 'boom','cookie': 'a=1; b=2; c=3'}});
 execute({headers: {'x-foo': 'boom','cookie': ['a=1','b=2','c=3']}});
-execute({headers: [['x-foo','boom'],['cookie','a=1; b=2; c=3']]});
 execute({headers: [
-['x-foo','boom'],['cookie',['a=1','b=2','c=3']],
+['x-foo','boom'],
+['cookie','a=1; b=2; c=3'],
+['Host','example.com'],
+]});
+execute({headers: [
+['x-foo','boom'],
+['cookie',['a=1','b=2','c=3']],
+['Host','example.com'],
 ]});
 execute({headers: [
 ['x-foo','boom'],['cookie','a=1'],
-['cookie','b=2'],['cookie','c=3'],
+['cookie','b=2'],['cookie','c=3'],
+['Host','example.com'],
 ]});
 
 // Authorization and Host header both missing from the second
@@ -58,4 +66,5 @@ execute({ auth: 'foo:bar', headers:
 execute({auth: 'foo:bar',headers: [
 ['x-foo','boom'],['cookie','a=1'],
 ['cookie','b=2'],['cookie','c=3'],
+['Host','example.com'],
 ]});

test/parallel/test-http-content-length.js

@@ -28,15 +28,18 @@ const server = http.createServer(function(req, res) {
 
 switch(req.url.substr(1)){
 case'multiple-writes':
+deletereq.headers.host;
 assert.deepStrictEqual(req.headers,expectedHeadersMultipleWrites);
 res.write('hello');
 res.end('world');
 break;
 case'end-with-data':
+deletereq.headers.host;
 assert.deepStrictEqual(req.headers,expectedHeadersEndWithData);
 res.end('hello world');
 break;
 case'empty':
+deletereq.headers.host;
 assert.deepStrictEqual(req.headers,expectedHeadersEndNoData);
 res.end();
 break;
@@ -56,7 +59,6 @@ server.listen(0, function() {
 path: '/multiple-writes'
 });
 req.removeHeader('Date');
-req.removeHeader('Host');
 req.write('hello ');
 req.end('world');
 req.on('response',function(res){
@@ -70,7 +72,6 @@ server.listen(0, function() {
 path: '/end-with-data'
 });
 req.removeHeader('Date');
-req.removeHeader('Host');
 req.end('hello world');
 req.on('response',function(res){
 assert.deepStrictEqual(res.headers,{ ...expectedHeadersEndWithData,'keep-alive': 'timeout=1'});
@@ -83,7 +84,6 @@ server.listen(0, function() {
 path: '/empty'
 });
 req.removeHeader('Date');
-req.removeHeader('Host');
 req.end();
 req.on('response',function(res){
 assert.deepStrictEqual(res.headers,{ ...expectedHeadersEndNoData,'keep-alive': 'timeout=1'});

test/parallel/test-http-header-badrequest.js

@@ -17,7 +17,7 @@ server.listen(0, mustCall(() => {
 letreceived='';
 
 c.on('connect',mustCall(()=>{
-c.write('GET /blah HTTP/1.1\r\n\r\n');
+c.write('GET /blah HTTP/1.1\r\nHost: example.com\r\n\r\n');
 }));
 c.on('data',mustCall((data)=>{
 received+=data.toString();

test/parallel/test-http-insecure-parser-per-stream.js

@@ -22,6 +22,7 @@ const MakeDuplexPair = require('../common/duplexpair');
 
 serverSide.resume();// Dump the request
 serverSide.end('HTTP/1.1 200 OK\r\n'+
+'Host: example.com\r\n'+
 'Hello: foo\x08foo\r\n'+
 'Content-Length: 0\r\n'+
 '\r\n\r\n');
@@ -39,6 +40,7 @@ const MakeDuplexPair = require('../common/duplexpair');
 
 serverSide.resume();// Dump the request
 serverSide.end('HTTP/1.1 200 OK\r\n'+
+'Host: example.com\r\n'+
 'Hello: foo\x08foo\r\n'+
 'Content-Length: 0\r\n'+
 '\r\n\r\n');
@@ -62,6 +64,7 @@ const MakeDuplexPair = require('../common/duplexpair');
 server.emit('connection',serverSide);
 
 clientSide.write('GET / HTTP/1.1\r\n'+
+'Host: example.com\r\n'+
 'Hello: foo\x08foo\r\n'+
 '\r\n\r\n');
 }
@@ -77,6 +80,7 @@ const MakeDuplexPair = require('../common/duplexpair');
 server.emit('connection',serverSide);
 
 clientSide.write('GET / HTTP/1.1\r\n'+
+'Host: example.com\r\n'+
 'Hello: foo\x08foo\r\n'+
 '\r\n\r\n');
 }

test/parallel/test-http-insecure-parser.js

@@ -19,6 +19,7 @@ server.listen(0, common.mustCall(function() {
 client.write(
 'GET / HTTP/1.1\r\n'+
 'Content-Type: text/te\x08t\r\n'+
+'Host: example.com'+
 'Connection: close\r\n\r\n');
 }
 );

test/parallel/test-http-keep-alive-drop-requests.js

@@ -8,6 +8,7 @@ const assert = require('assert');
 functionrequest(socket){
 socket.write('GET / HTTP/1.1\r\n');
 socket.write('Connection: keep-alive\r\n');
+socket.write('Host: localhost\r\n');
 socket.write('\r\n\r\n');
 }