Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

http: disallow two-byte characters in URL path #16237

Closed
wants to merge 4 commits into from
Closed

http: disallow two-byte characters in URL path #16237

wants to merge 4 commits into from
+14 −34

Commits on Nov 22, 2017

  1. http: disallow two-byte characters in URL path 

    This commit changes node's handling of two-byte characters in the path component
of an http URL. Previously, node would just strip the higher byte when
generating the request. So this code:

```
http.request({host: "example.com", port: "80", "/\uFF2e"})
```

would request `http://example.com/.` (`.` is the character for the byte `0x2e`).

This is not useful and can in some cases lead to filter evasion. With this
change, the code generates `ERR_UNESCAPED_CHARACTERS`, just like space and
control characters already did.
    @bennofs
    bennofs committed Nov 22, 2017
    Configuration menu
    Copy the full SHA
    844a470 View commit details
    Browse the repository at this point in the history

  2. fixup! http: disallow two-byte characters in URL path

    @bennofs
    bennofs committed Nov 22, 2017
    Configuration menu
    Copy the full SHA
    eab523c View commit details
    Browse the repository at this point in the history

  3. fixup! http: disallow two-byte characters in URL path

    @bennofs
    bennofs committed Nov 22, 2017
    Configuration menu
    Copy the full SHA
    58ac26f View commit details
    Browse the repository at this point in the history

  4. http: always use regex for invalid path check 

    Using the "optimized" version was not significantly faster and even
slower for larger n.
    @bennofs
    bennofs committed Nov 22, 2017
    Configuration menu
    Copy the full SHA
    60b3290 View commit details
    Browse the repository at this point in the history