http server. empty reply on GET request with not url encoded GET-param

[alekzonder]

• Version: 4.4.3, 5.10.1
• Platform: OS X 10.11.4, UBUNTU 14.04.3 LTS
• Subsystem: net

OS X uname -a

Darwin mac 15.4.0 Darwin Kernel Version 15.4.0: Fri Feb 26 22:08:05 PST 2016; root:xnu-3248.40.184~3/RELEASE_X86_64 x86_64 

Ubuntu uname -a

Linux cs10831 3.13.0-68-generic #111-Ubuntu SMP Fri Nov 6 18:17:06 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

server.js

var http = require('http');
var url = require('url');
var querystring = require('querystring');

function accept(req, res) {

    console.log('GET request', req.url);

    res.writeHead(200, {
        'Content-Type': 'text/plain',
        'Cache-Control': 'no-cache'
    });

    res.end("OK");
}

http.createServer(accept).listen(5555);

starting server with NODE_DEBUG=net

NODE_DEBUG=net node server.js

curl request

GET param name without urlencode

$ curl -v "http://localhost:5555?test=1 2"
* Rebuilt URL to: http://localhost:5555/?test=1 2
*   Trying ::1...
* Connected to localhost (::1) port 5555 (#0)
> GET /?test=1 2 HTTP/1.1
> Host: localhost:5555
> User-Agent: curl/7.43.0
> Accept: */*
>
* Empty reply from server
* Connection #0 to host localhost left intact
curl: (52) Empty reply from server

server debug log

NET 79849: listen2 null 5555 4 false undefined
NET 79849: _listen2: create a handle
NET 79849: bind to ::
NET 79849: onconnection
NET 79849: _read
NET 79849: Socket._read readStart
NET 79849: destroy { [Error: Parse Error] bytesParsed: 13, code: 'HPE_INVALID_CONSTANT' }
NET 79849: destroy
NET 79849: close
NET 79849: close handle
NET 79849: has server
NET 79849: SERVER _emitCloseIfDrained
NET 79849: SERVER handle? true   connections? 0
NET 79849: destroy { [Error: Parse Error] bytesParsed: 13, code: 'HPE_INVALID_CONSTANT' }
NET 79849: destroy
NET 79849: already destroyed, fire error callbacks
NET 79849: emit close

success request with urlencoded

curl

$ curl -v "http://localhost:5555?test=1%202"
* Rebuilt URL to: http://localhost:5555/?test=1%202
*   Trying ::1...
* Connected to localhost (::1) port 5555 (#0)
> GET /?test=1%202 HTTP/1.1
> Host: localhost:5555
> User-Agent: curl/7.43.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Content-Type: text/plain
< Cache-Control: no-cache
< Date: Wed, 20 Apr 2016 05:23:15 GMT
< Connection: keep-alive
< Transfer-Encoding: chunked
<
* Connection #0 to host localhost left intact
OK

server debug log

NET 79849: onconnection
NET 79849: _read
NET 79849: Socket._read readStart
GET request /?test=1%202
NET 79849: afterWrite 0
NET 79849: afterWrite call cb
NET 79849: onread -4095
NET 79849: EOF
NET 79849: onSocketEnd ReadableState {
  objectMode: false,
  highWaterMark: 16384,
  buffer: [],
  length: 0,
  pipes: null,
  pipesCount: 0,
  flowing: true,
  ended: true,
  endEmitted: false,
  reading: false,
  sync: false,
  needReadable: false,
  emittedReadable: false,
  readableListening: false,
  resumeScheduled: false,
  defaultEncoding: 'utf8',
  ranOut: false,
  awaitDrain: 0,
  readingMore: false,
  decoder: null,
  encoding: null }
NET 79849: onSocketFinish
NET 79849: oSF: ended, destroy ReadableState {
  objectMode: false,
  highWaterMark: 16384,
  buffer: [],
  length: 0,
  pipes: null,
  pipesCount: 0,
  flowing: true,
  ended: true,
  endEmitted: true,
  reading: false,
  sync: false,
  needReadable: false,
  emittedReadable: false,
  readableListening: false,
  resumeScheduled: false,
  defaultEncoding: 'utf8',
  ranOut: false,
  awaitDrain: 0,
  readingMore: false,
  decoder: null,
  encoding: null }
NET 79849: destroy undefined
NET 79849: destroy
NET 79849: close
NET 79849: close handle
NET 79849: has server
NET 79849: SERVER _emitCloseIfDrained
NET 79849: SERVER handle? true   connections? 0
NET 79849: emit close

[bnoordhuis]

Quoting the relevant part:

curl -v "http://localhost:5555?test=1 2"

That makes curl send an invalid HTTP request. To wit:

$ strace -s 1024 -e sendto curl "http://localhost:5555?test=1 2"
sendto(3, "GET /?test=1 2 HTTP/1.1\r\nHost: localhost:5555\r\nUser-Agent: curl/7.43.0\r\nAccept: */*\r\n\r\n", 87, MSG_NOSIGNAL, NULL, 0) = 87
curl: (52) Empty reply from server
+++ exited with 52 +++

The salient part is the request line - GET /?test=1 2 HTTP/1.1\r\n - which is clearly malformed.

Closing, not a bug in node.js.

[alekzonder]

@bnoordhuis But why in Golang or Python i got "400 Bad Request" for unencoded space in GET-param value?

golang

server.go

package main

import (
    "fmt"
    "net/http"
)

func handler(w http.ResponseWriter, r *http.Request) {
    fmt.Fprintf(w, "Hello World")
}

func main() {
    http.HandleFunc("/", handler)
    http.ListenAndServe(":5555", nil)
}

curl

$ curl -v "http://localhost:5555?asd=asd asd"
* Rebuilt URL to: http://localhost:5555/?asd=asd asd
*   Trying ::1...
* Connected to localhost (::1) port 5555 (#0)
> GET /?asd=asd asd HTTP/1.1
> Host: localhost:5555
> User-Agent: curl/7.43.0
> Accept: */*
>
< HTTP/1.1 400 Bad Request
* no chunk, no close, no size. Assume close to signal end
<
* Closing connection 0

python

server.py

#!/usr/bin/python
from BaseHTTPServer import BaseHTTPRequestHandler,HTTPServer

PORT_NUMBER = 5555

class myHandler(BaseHTTPRequestHandler):

    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-type','text/html')
        self.end_headers()
        self.wfile.write("Hello World !")
        return

try:
    server = HTTPServer(('', PORT_NUMBER), myHandler)
    print 'Started httpserver on port ' , PORT_NUMBER
    server.serve_forever()

except KeyboardInterrupt:
    print '^C received, shutting down the web server'
    server.socket.close()

curl

 curl -v "http://localhost:5555?asd=asd asd"
* Rebuilt URL to: http://localhost:5555/?asd=asd asd
*   Trying ::1...
* connect to ::1 port 5555 failed: Connection refused
*   Trying fe80::1...
* connect to fe80::1 port 5555 failed: Connection refused
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 5555 (#0)
> GET /?asd=asd asd HTTP/1.1
> Host: localhost:5555
> User-Agent: curl/7.43.0
> Accept: */*
>
<head>
<title>Error response</title>
</head>
<body>
<h1>Error response</h1>
<p>Error code 400.
<p>Message: Bad request syntax ('GET /?asd=asd asd HTTP/1.1').
<p>Error code explanation: 400 = Bad request syntax or unsupported method.
</body>
* Connection #0 to host localhost left intact

in node.js no response at all

$ curl -v "http://localhost:5555?asd=asd asd"
* Rebuilt URL to: http://localhost:5555/?asd=asd asd
*   Trying ::1...
* Connected to localhost (::1) port 5555 (#0)
> GET /?asd=asd asd HTTP/1.1
> Host: localhost:5555
> User-Agent: curl/7.43.0
> Accept: */*
>
* Empty reply from server
* Connection #0 to host localhost left intact
curl: (52) Empty reply from server```

[bnoordhuis]

You can send a 400 response if you want but node doesn't do it by default:

http.createServer(...).listen(port).on('clientError', (err, conn) => {
  console.error(err);
  conn.end(
      'HTTP/1.1 400 Bad Request\r\n' +
      'Content-Length: 0\r\n' +
      '\r\n');
});

[cristianbote]

FYI, if somebody else is stumbling over this, it has been taken care of here #15324

[atefBB]

@cristianbote Any ideas to solve this issue?
I don't understand the content in the link #15324 !