Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detect and trim any invalid incoming req header name #1276

Open
wants to merge 3 commits into
base: master
from

Conversation

Projects
None yet
1 participant
@dino-brzika
Copy link

dino-brzika commented Jun 20, 2018

Issue #1261
In web-incoming.js it is not handled if incoming req header name start or end with whitespace.
Result is crashing of application. Issue is easy to reproduce by manually adding in req headers header with whitespace (example 'cookie '). In production issue is observed on node 4.8.0 and http-proxy 1.16.2 version. Application is build in Meteor which does not handle this as well.
Submitted solution is to loop through req headers and when invalid header is detected, add new header with trimmed name and remove existing invalid header. In addition to this it will replace remaining whitespaces with dash(-). This is needed in order to handle case where header is named like "foo bar".
Fix verified on node 4.8.0 and all tests passed.

Dino added some commits Jun 20, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.