Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

deno 0.5.0 - http server crash with incoming https request #2346

Closed
JoakimCh opened this issue May 13, 2019 · 4 comments · Fixed by denoland/std#419
Closed

deno 0.5.0 - http server crash with incoming https request #2346

JoakimCh opened this issue May 13, 2019 · 4 comments · Fixed by denoland/std#419
Labels
bug Something isn't working correctly
Milestone

Comments

@JoakimCh
Copy link

The http server will crash if it has an incoming https request, with this error:

Uncaught ProtocolError: malformed MIME header line

In http lib's readRequest this line causes the error:
[req.headers, err] = await tp.readMIMEHeader()

It's trying to read the https request, but since it's encrypted it fails at doing this. But there should be a way to detect such requests and just deny them without crashing the server.

@ry ry added the bug Something isn't working correctly label May 13, 2019
@ry ry added this to the v1.0 milestone May 13, 2019
@zekth
Copy link
Contributor

zekth commented May 13, 2019

@ry as HTTPS is not implemented yet a solution would be to do a redirect on http protocol? Or return an error 503?

@ry
Copy link
Member

ry commented May 13, 2019

@zekth return 400

$ python -m SimpleHTTPServer 8000
Serving HTTP on 0.0.0.0 port 8000 ...
127.0.0.1 - - [13/May/2019 18:12:23] "GET / HTTP/1.1" 200 -
127.0.0.1 - - [13/May/2019 18:12:29] code 400, message Bad request syntax ('\x16\x03\x01\x00\xd7\x01\x00\x00\xd3\x03\x03\x92\xdb\xf9\xb5m\x9c\x1b\x1aH\xc9\x9f\xb2~\x92\xf1x.\x9f\xfb\xe3\x1b\xe9\xba+\xff)db\x12\x81\xe3\x97\x00\x00T\xcc\xa9\xcc\xa8\xcc\xaa\xc00\xc0,\xc0(\xc0$\xc0\x14\xc0')
127.0.0.1 - - [13/May/2019 18:12:29] "�����m�Hɟ�~��x.����+�)db��T̨̩̪�0�,�(�$��" 400 -

in another terminal run:

$ curl https://localhost:8000/
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number

@bartlomieju
Copy link
Member

Resolved in denoland/std#415?

@zekth
Copy link
Contributor

zekth commented May 19, 2019

Resolved in denoland/deno_std#415?

not related. This PR solve the problem of handling the end of the mime header but not encrypted mime. So it will still try to read the mime header but will fail.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working correctly
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants