Skip to content

v8_inspector: any netty-based WS client cannot connect to inspector because Sec-WebSocket-Key check is not case-insensitive #7247

@develar

Description

@develar

If you try to connect to node inspector ws://127.0.0.1:9229/node, you get 400 Bad Request.

Because check

  } else if (!state->ws_key) {
    handshake_failed(inspector);
  }

in the inspector_socket.cc:523 failed.

Bug in the header_value_cb function — header Sec-WebSocket-Key is expected and it checked case-sensitive. But Netty sends this header as sec-websocket-key.

static int header_value_cb(http_parser* parser, const char* at, size_t length) {
      char SEC_WEBSOCKET_KEY_HEADER[] = "Sec-WebSocket-Key";
      struct http_parsing_state_s* state = (struct http_parsing_state_s*)
      (reinterpret_cast<inspector_socket_t*>(parser->data))->http_parsing_state;
  state->parsing_value = true;
  if (state->current_header && strncmp(state->current_header,
                                       SEC_WEBSOCKET_KEY_HEADER,
                                       sizeof(SEC_WEBSOCKET_KEY_HEADER)) == 0) {
    append(&state->ws_key, at, length);
  }
  return 0;
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    inspectorIssues and PRs related to the V8 inspector protocol

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions