HTTP response corrupted with status 400 when URL includes pipe character (|)

Version: v12.1.0 v12.0.0
Platform: MacOS 10.14.2 - Darwin Kernel Version 18.5.0: Mon Mar 11 20:40:32 PDT 2019; root:xnu-4903.251.3~3/RELEASE_X86_64 x8
6_64

My code:

index.js

var http = require('http');
var url = require('url');

http.createServer(function (req, res) {
  res.writeHead(200, { 'Content-Type': 'text/html' });
  var q = url.parse(req.url, true).query;
  var search = q.search;
  res.end(search);
}).listen(8080);

Starting command: node index.js

Chrome: Version 74.0.3729.131 (Official Build) (64-bit)

When I try to request to my http service, it is working fine with normal url like
http://localhost:8080/?search=example

But, when the url come to http://localhost:8080/?search=example| or http://localhost:8080/?sea|rch=example . My browser gets back This page isn’t working and HTTP ERROR 400 (the request did not appeared on Network tab of Chrome devtool) .

Try again with curl or Postman, these urls are working fine 🤔

=> When I use older node version like v11.11.0 I don't get any errors.

Thank you for reporting this bug! It’s an issue that seems to occur because we switched out the HTTP parser library default in Node 12. The good news is that you can use --http-parser=legacy to work around this issue for now, and get consistent behaviour on both v11.x and v12.x.

@indutny

Yes, this seems like something that should be fixed in llhttp to me. At least browsers and curl do not percent-encode | in the given example URLs.

/cc @indutny @nodejs/http

/me is on it

@hoangsetup

🤦 I literally missed this single character. Thank you @hoangsetup for catching this!

constants: add `|` to list of allowed URL chars

See: nodejs/llhttp#24

constants: add `|` to list of allowed URL chars

deps: update llhttp to 1.1.3

constants: add `|` to list of allowed URL chars

deps: update llhttp to 1.1.3

Navigation Menu

Repository navigation

HTTP response corrupted with status 400 when URL includes pipe character (`|`) #27584

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

HTTP response corrupted with status 400 when URL includes pipe character (|) #27584

Description

Activity

addaleax commented on May 6, 2019

addaleax commented on May 6, 2019

indutny commented on May 6, 2019

indutny commented on May 6, 2019

indutny commented on May 6, 2019

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

HTTP response corrupted with status 400 when URL includes pipe character (`|`) #27584