-
Notifications
You must be signed in to change notification settings - Fork 29k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
http: disallow two-byte characters in URL path
This commit changes node's handling of two-byte characters in the path component of an http URL. Previously, node would just strip the higher byte when generating the request. So this code: ``` http.request({host: "example.com", port: "80", "/N"}) ``` would request `http://example.com/.` (`.` is the character for the byte `0x2e`). This is not useful and can in some cases lead to filter evasion. With this change, the code generates `ERR_UNESCAPED_CHARACTERS`, just like space and control characters already did. PR-URL: #16237 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Anatoli Papirovski <apapirovski@mac.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Timothy Gu <timothygu99@gmail.com>
- Loading branch information
Showing
2 changed files
with
14 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
'use strict'; | ||
const common = require('../common'); | ||
const http = require('http'); | ||
|
||
common.expectsError(() => { | ||
http.request({ | ||
path: '/thisisinvalid\uffe2' | ||
}).end(); | ||
}, { | ||
code: 'ERR_UNESCAPED_CHARACTERS', | ||
type: TypeError | ||
}); |
b961d9f
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What are the implications of this change for Internationalized Domain Names (IDNs)?
b961d9f
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/ping @nodejs/http @nodejs/i18n
b961d9f
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
IDNs must be converted to ascii form to be valid within a URL.
b961d9f
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In case of a URL string being passed in,
url.parse()
(andnew URL()
) will automatically punycode-encode the host.