Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detect and trim any invalid incoming req header name #1276

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

dino-brzika
Copy link

@dino-brzika dino-brzika commented Jun 20, 2018

Issue #1261
In web-incoming.js it is not handled if incoming req header name start or end with whitespace.
Result is crashing of application. Issue is easy to reproduce by manually adding in req headers header with whitespace (example 'cookie '). In production issue is observed on node 4.8.0 and http-proxy 1.16.2 version. Application is build in Meteor which does not handle this as well.
Submitted solution is to loop through req headers and when invalid header is detected, add new header with trimmed name and remove existing invalid header. In addition to this it will replace remaining whitespaces with dash(-). This is needed in order to handle case where header is named like "foo bar".
Fix verified on node 4.8.0 and all tests passed.

@codecov-io
Copy link

Codecov Report

❗ No coverage uploaded for pull request base (master@a3fe02d). Click here to learn what that means.
The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff            @@
##             master    #1276   +/-   ##
=========================================
  Coverage          ?   92.54%           
=========================================
  Files             ?        6           
  Lines             ?      322           
  Branches          ?        0           
=========================================
  Hits              ?      298           
  Misses            ?       24           
  Partials          ?        0
Impacted Files Coverage Δ
lib/http-proxy/passes/web-incoming.js 98.52% <100%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a3fe02d...6d65ac0. Read the comment docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants