test: check that --insecure-http-parser works by sam-github · Pull Request #31253 · nodejs/node

sam-github · 2020-01-07T22:27:50Z

Test that using --insecure-http-parser will disable validation of
invalid characters in HTTP headers.

See:

http: llhttp opt-in insecure HTTP header parsing #30567

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
commit message follows commit guidelines

nodejs-github-bot · 2020-01-07T22:40:04Z

CI: https://ci.nodejs.org/job/node-test-pull-request/28273/

nodejs-github-bot · 2020-01-07T23:08:02Z

CI: https://ci.nodejs.org/job/node-test-pull-request/28275/

nodejs-github-bot · 2020-01-08T01:15:15Z

CI: https://ci.nodejs.org/job/node-test-pull-request/28281/

sam-github · 2020-01-08T18:20:29Z

Note that the test fails when the required CLI param is not present:

% NODE_SKIP_FLAG_CHECK=y ~/.nvm/versions/node/v12.14.0/bin/node test/parallel/test-http-insecure-parser.js assert.js:92
throw new AssertionError(obj);
^
AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:
+ actual - expected
+ 'HTTP/1.1 400 Bad Request'
- 'HTTP/1.1 200 OK'
^
at Socket.<anonymous> (/home/sam/w/core/node/test/parallel/test-http-insecure-parser.js:32:12)
at Socket.<anonymous> (/home/sam/w/core/node/test/common/index.js:358:15)
at Socket.emit (events.js:215:7)
at endReadableNT (_stream_readable.js:1184:12)
at processTicksAndRejections (internal/process/task_queues.js:80:21) {
generatedMessage: true,
code: 'ERR_ASSERTION',
actual: 'HTTP/1.1 400 Bad Request',
expected: 'HTTP/1.1 200 OK',
operator: 'strictEqual'
}

nodejs-github-bot · 2020-01-08T18:21:10Z

CI: https://ci.nodejs.org/job/node-test-pull-request/28302/

Test that using --insecure-http-parser will disable validation of invalid characters in HTTP headers. See: - nodejs#30567

nodejs-github-bot · 2020-01-09T16:16:58Z

CI: https://ci.nodejs.org/job/node-test-pull-request/28326/

sam-github · 2020-01-09T16:23:18Z

@addaleax @nodejs/http

nodejs-github-bot · 2020-01-09T17:01:22Z

CI: https://ci.nodejs.org/job/node-test-pull-request/28328/

Test that using --insecure-http-parser will disable validation of invalid characters in HTTP headers. See: - #30567 PR-URL: #31253 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

sam-github · 2020-01-09T23:32:19Z

Landed in e4bff13

Test that using --insecure-http-parser will disable validation of invalid characters in HTTP headers. See: - nodejs#30567 PR-URL: nodejs#31253 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Test that using --insecure-http-parser will disable validation of invalid characters in HTTP headers. See: - #30567 PR-URL: #31253 Backport-PR-URL: #30473 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Test that using --insecure-http-parser will disable validation of invalid characters in HTTP headers. See: - #30567 PR-URL: #31253 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Backport ab1fcb8 Original commit message: Test that using --insecure-http-parser will disable validation of invalid characters in HTTP headers. See: - nodejs/node#30567 PR-URL: nodejs/node#31253 Backport-PR-URL: nodejs/node#30473 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Ported from OpenSUSE:nodejs8-8.17.0-lp152.147.1:CVE-2019-15605.patch Original commit message: commit e2c8f89 Author: Sam Roberts <vieuxtech@gmail.com> Date: Thu Jan 16 11:55:52 2020 -0800 test: using TE to smuggle reqs is not possible See: https://hackerone.com/reports/735748 PR-URL: https://github.com/nodejs-private/node-private/pull/192 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> commit 49f4220 Author: Sam Roberts <vieuxtech@gmail.com> Date: Tue Feb 4 10:36:57 2020 -0800 deps: upgrade http-parser to v2.9.3 PR-URL: https://github.com/nodejs-private/http-parser-private/pull/4 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> commit d616722 Author: Sam Roberts <vieuxtech@gmail.com> Date: Tue Jan 7 14:24:54 2020 -0800 test: check that --insecure-http-parser works Test that using --insecure-http-parser will disable validation of invalid characters in HTTP headers. See: - nodejs#30567 Backport-PR-URL: nodejs#30471 PR-URL: nodejs#31253 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> commit a9849c0 Author: Sam Roberts <vieuxtech@gmail.com> Date: Wed Nov 20 11:48:58 2019 -0800 http: opt-in insecure HTTP header parsing Allow insecure HTTP header parsing. Make clear it is insecure. See: - nodejs#30553 - nodejs#27711 (comment) - nodejs#30515 Backport-PR-URL: nodejs#30471 PR-URL: nodejs#30567 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Denys Otrishko <shishugi@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> commit a28e5cc Author: Sam Roberts <vieuxtech@gmail.com> Date: Wed Nov 13 10:05:38 2019 -0800 deps: upgrade http-parser to v2.9.1 PR-URL: nodejs#30471 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Signed-off-by: Su Baocheng <baocheng.su@siemens.com>

nodejs-github-bot added the test Issues and PRs related to the tests. label Jan 7, 2020

This was referenced Jan 7, 2020
http: llhttp opt-in insecure HTTP header parsing #30567
Closed
Update http parser 2.9.1 v12.x #30473
Closed
Update http parser 2.9.1 v10.x #30471
Closed

sam-github force-pushed the test-insecure-http-parser branch from 3207505 to ecb644dCompare January 7, 2020 23:05

richardlau approved these changes Jan 8, 2020
View reviewed changes

addaleax reviewed Jan 8, 2020
View reviewed changes

Comment threadtest/parallel/test-http-insecure-parser.js Outdated

sam-github force-pushed the test-insecure-http-parser branch from 38aaeb5 to 6514a0bCompare January 8, 2020 18:18

test: check that --insecure-http-parser works
57ef733
Test that using --insecure-http-parser will disable validation of invalid characters in HTTP headers. See: - nodejs#30567

sam-github force-pushed the test-insecure-http-parser branch from 6514a0b to 57ef733Compare January 9, 2020 16:16

BridgeAR approved these changes Jan 9, 2020
View reviewed changes

BridgeAR added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Jan 9, 2020

sam-github closed this Jan 9, 2020

sam-github deleted the test-insecure-http-parser branch January 9, 2020 23:33

sam-github added backport-open-v12.x labels Jan 10, 2020

sam-github added dont-land-on-v10.x labels Jan 10, 2020

targos added backported-to-v12.x and removed backport-open-v12.x labels Jan 14, 2020

targos mentioned this pull request Jan 15, 2020
v12.15.0 release proposal #31368
Closed

codebytere mentioned this pull request Jan 16, 2020
v13.7.0 proposal #31382
Merged

Navigation Menu

Uh oh!

Uh oh!

test: check that --insecure-http-parser works - #31253

test: check that --insecure-http-parser works#31253
sam-github wants to merge 1 commit into
nodejs:masterfrom
sam-github:test-insecure-http-parser

sam-github commented Jan 7, 2020•
edited
Loading

Uh oh!

nodejs-github-bot commented Jan 7, 2020

Uh oh!

nodejs-github-bot commented Jan 7, 2020

Uh oh!

nodejs-github-bot commented Jan 8, 2020

Uh oh!

Uh oh!

sam-github commented Jan 8, 2020

Uh oh!

nodejs-github-bot commented Jan 8, 2020

Uh oh!

nodejs-github-bot commented Jan 9, 2020

Uh oh!

sam-github commented Jan 9, 2020

Uh oh!

nodejs-github-bot commented Jan 9, 2020

Uh oh!

sam-github commented Jan 9, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Uh oh!

Conversation

sam-github commented Jan 7, 2020• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Uh oh!

nodejs-github-bot commented Jan 7, 2020

Uh oh!

nodejs-github-bot commented Jan 7, 2020

Uh oh!

nodejs-github-bot commented Jan 8, 2020

Uh oh!

Uh oh!

sam-github commented Jan 8, 2020

Uh oh!

nodejs-github-bot commented Jan 8, 2020

Uh oh!

nodejs-github-bot commented Jan 9, 2020

Uh oh!

sam-github commented Jan 9, 2020

Uh oh!

nodejs-github-bot commented Jan 9, 2020

Uh oh!

sam-github commented Jan 9, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

sam-github commented Jan 7, 2020•
edited
Loading