http: disallow two-byte characters in URL path

This commit changes node's handling of two-byte characters in the path component
of an http URL. Previously, node would just strip the higher byte when
generating the request. So this code:

```
http.request({host: "example.com", port: "80", "/\uFF2e"})
```

would request `http://example.com/.` (`.` is the character for the byte `0x2e`).

This is not useful and can in some cases lead to filter evasion. With this
change, the code generates `ERR_UNESCAPED_CHARACTERS`, just like space and
control characters already did.

lib/_http_client.js

@@ -52,20 +52,20 @@ const errors = require('internal/errors');
 // checks can greatly outperform the equivalent regexp (tested in V8 5.4).
 function isInvalidPath(s) {
   var i = 0;
-  if (s.charCodeAt(0) <= 32) return true;
+  if (s.charCodeAt(0) <= 32 || s.charCodeAt(0) > 0xFF) return true;
   if (++i >= s.length) return false;
-  if (s.charCodeAt(1) <= 32) return true;
+  if (s.charCodeAt(1) <= 32 || s.charCodeAt(1) > 0xFF) return true;
   if (++i >= s.length) return false;
-  if (s.charCodeAt(2) <= 32) return true;
+  if (s.charCodeAt(2) <= 32 || s.charCodeAt(2) > 0xFF) return true;
   if (++i >= s.length) return false;
-  if (s.charCodeAt(3) <= 32) return true;
+  if (s.charCodeAt(3) <= 32 || s.charCodeAt(3) > 0xFF) return true;
   if (++i >= s.length) return false;
-  if (s.charCodeAt(4) <= 32) return true;
+  if (s.charCodeAt(4) <= 32 || s.charCodeAt(4) > 0xFF) return true;
   if (++i >= s.length) return false;
-  if (s.charCodeAt(5) <= 32) return true;
+  if (s.charCodeAt(5) <= 32 || s.charCodeAt(5) > 0xFF) return true;
   ++i;
   for (; i < s.length; ++i)
-    if (s.charCodeAt(i) <= 32) return true;
+    if (s.charCodeAt(i) <= 32 || s.charCodeAt(i) > 0xFF) return true;
   return false;
 }
 
@@ -121,7 +121,7 @@ function ClientRequest(options, cb) {
     if (path.length <= 39) { // Determined experimentally in V8 5.4
       invalidPath = isInvalidPath(path);
     } else {
-      invalidPath = /[\u0000-\u0020]/.test(path);
+      invalidPath = /[\u0000-\u0020\u0100-\uffff]/.test(path);
     }
     if (invalidPath)
       throw new errors.TypeError('ERR_UNESCAPED_CHARACTERS', 'Request path');

test/parallel/test-http-client-invalid-path.js

@@ -0,0 +1,33 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+'use strict';
+const common = require('../common');
+const http = require('http');
+
+common.expectsError(() => {
+  http.request({
+    path: '/thisisinvalid\uffe2'
+  }).end();
+}, {
+  code: 'ERR_UNESCAPED_CHARACTERS',
+  type: TypeError
+});