http: reject control characters in http.request()

lib/_http_client.js

@@ -43,13 +43,12 @@ function ClientRequest(options, cb) {
   if (self.agent && self.agent.protocol)
     expectedProtocol = self.agent.protocol;
 
-  if (options.path && / /.test(options.path)) {
+  if (options.path && /[\u0000-\u0020]/.test(options.path)) {
     // The actual regex is more like /[^A-Za-z0-9\-._~!$&'()*+,;=/:@]/
     // with an additional rule for ignoring percentage-escaped characters
     // but that's a) hard to capture in a regular expression that performs
-    // well, and b) possibly too restrictive for real-world usage. That's
-    // why it only scans for spaces because those are guaranteed to create
-    // an invalid request.
+    // well, and b) possibly too restrictive for real-world usage.
+    // Restrict the filter to control characters and spaces.
     throw new TypeError('Request path contains unescaped characters');
   } else if (protocol !== expectedProtocol) {
     throw new Error('Protocol "' + protocol + '" not supported. ' +

test/parallel/test-http-client-unescaped-path.js

@@ -1,9 +1,14 @@
 'use strict';
-var common = require('../common');
-var assert = require('assert');
-var http = require('http');
+const common = require('../common');
+const assert = require('assert');
+const http = require('http');
 
-assert.throws(function() {
-  // Path with spaces in it should throw.
-  http.get({ path: 'bad path' }, common.fail);
-}, /contains unescaped characters/);
+function* bad() {
+  for (let i = 0; i <= 32; i += 1)
+    yield 'bad' + String.fromCharCode(i) + 'path';
+}
+
+for (const path of bad()) {
+  assert.throws(() => http.get({ path }, common.fail),
+                /contains unescaped characters/);
+}