Skip to content

Commit 01bffcd

Browse files
ShogunPandaRafaelGSS
ShogunPanda
authored and
RafaelGSS
committedSep 22, 2022
http: disable chunked encoding when OBS fold is used
Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Vladimir de Turckheim <vlad2t@hotmail.com> PR-URL: #341 CVE-ID: CVE-2022-32213, CVE-2022-32215, CVE-2022-35256
·
v18.20.8v18.9.1
1 parent 0c2a572 commit 01bffcd

6 files changed

+376
-284
lines changed
 

‎deps/llhttp/CMakeLists.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
cmake_minimum_required(VERSION 3.5.1)
22
cmake_policy(SET CMP0069 NEW)
33

4-
project(llhttp VERSION )
4+
project(llhttp VERSION 6.0.10)
55
include(GNUInstallDirs)
66

77
set(CMAKE_C_STANDARD 99)

‎deps/llhttp/include/llhttp.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
#define LLHTTP_VERSION_MAJOR 6
55
#define LLHTTP_VERSION_MINOR 0
6-
#define LLHTTP_VERSION_PATCH 9
6+
#define LLHTTP_VERSION_PATCH 10
77

88
#ifndef LLHTTP_STRICT_MODE
99
# define LLHTTP_STRICT_MODE 0

‎deps/llhttp/src/llhttp.c

+238-218
Large diffs are not rendered by default.

‎test/parallel/test-http-header-overflow.js

+2-7
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,11 @@ const assert = require('assert');
66
const { createServer, maxHeaderSize } = require('http');
77
const { createConnection } = require('net');
88

9-
const { getOptionValue } = require('internal/options');
10-
119
const CRLF = '\r\n';
1210
const DUMMY_HEADER_NAME = 'Cookie: ';
1311
const DUMMY_HEADER_VALUE = 'a'.repeat(
1412
// Plus one is to make it 1 byte too big
15-
maxHeaderSize - DUMMY_HEADER_NAME.length - (2 * CRLF.length) + 1
13+
maxHeaderSize - DUMMY_HEADER_NAME.length + 2
1614
);
1715
const PAYLOAD_GET = 'GET /blah HTTP/1.1';
1816
const PAYLOAD = PAYLOAD_GET + CRLF +
@@ -21,14 +19,11 @@ const PAYLOAD = PAYLOAD_GET + CRLF +
2119
const server = createServer();
2220

2321
server.on('connection', mustCall((socket) => {
24-
// Legacy parser gives sligthly different response.
25-
// This discripancy is not fixed on purpose.
26-
const legacy = getOptionValue('--http-parser') === 'legacy';
2722
socket.on('error', expectsError({
2823
name: 'Error',
2924
message: 'Parse Error: Header overflow',
3025
code: 'HPE_HEADER_OVERFLOW',
31-
bytesParsed: maxHeaderSize + PAYLOAD_GET.length - (legacy ? -1 : 0),
26+
bytesParsed: maxHeaderSize + PAYLOAD_GET.length + (CRLF.length * 2) + 1,
3227
rawPacket: Buffer.from(PAYLOAD)
3328
}));
3429
}));

‎test/parallel/test-http-missing-header-separator-cr.js

+56-16
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,7 @@ const assert = require('assert');
66
const http = require('http');
77
const net = require('net');
88

9-
const msg = [
10-
'GET / HTTP/1.1',
11-
'Host: localhost',
12-
'Dummy: x\nContent-Length: 23',
13-
'',
14-
'GET / HTTP/1.1',
15-
'Dummy: GET /admin HTTP/1.1',
16-
'Host: localhost',
17-
'',
18-
'',
19-
].join('\r\n');
20-
21-
const server = http.createServer(common.mustNotCall());
22-
23-
server.listen(0, common.mustSucceed(() => {
9+
function serverHandler(server, msg) {
2410
const client = net.connect(server.address().port, 'localhost');
2511

2612
let response = '';
@@ -40,4 +26,58 @@ server.listen(0, common.mustSucceed(() => {
4026
}));
4127
client.write(msg);
4228
client.resume();
43-
}));
29+
}
30+
31+
{
32+
const msg = [
33+
'GET / HTTP/1.1',
34+
'Host: localhost',
35+
'Dummy: x\nContent-Length: 23',
36+
'',
37+
'GET / HTTP/1.1',
38+
'Dummy: GET /admin HTTP/1.1',
39+
'Host: localhost',
40+
'',
41+
'',
42+
].join('\r\n');
43+
44+
const server = http.createServer(common.mustNotCall());
45+
46+
server.listen(0, common.mustSucceed(serverHandler.bind(null, server, msg)));
47+
}
48+
49+
{
50+
const msg = [
51+
'POST / HTTP/1.1',
52+
'Host: localhost',
53+
'x:x\nTransfer-Encoding: chunked',
54+
'',
55+
'1',
56+
'A',
57+
'0',
58+
'',
59+
'',
60+
].join('\r\n');
61+
62+
const server = http.createServer(common.mustNotCall());
63+
64+
server.listen(0, common.mustSucceed(serverHandler.bind(null, server, msg)));
65+
}
66+
67+
{
68+
const msg = [
69+
'POST / HTTP/1.1',
70+
'Host: localhost',
71+
'x:\nTransfer-Encoding: chunked',
72+
'',
73+
'1',
74+
'A',
75+
'0',
76+
'',
77+
'',
78+
].join('\r\n');
79+
80+
const server = http.createServer(common.mustNotCall());
81+
82+
server.listen(0, common.mustSucceed(serverHandler.bind(null, server, msg)));
83+
}

‎test/parallel/test-http-transfer-encoding-smuggling.js

+78-41
Original file line numberDiff line numberDiff line change
@@ -6,47 +6,84 @@ const assert = require('assert');
66
const http = require('http');
77
const net = require('net');
88

9-
const msg = [
10-
'POST / HTTP/1.1',
11-
'Host: 127.0.0.1',
12-
'Transfer-Encoding: chunked',
13-
'Transfer-Encoding: chunked-false',
14-
'Connection: upgrade',
15-
'',
16-
'1',
17-
'A',
18-
'0',
19-
'',
20-
'GET /flag HTTP/1.1',
21-
'Host: 127.0.0.1',
22-
'',
23-
'',
24-
].join('\r\n');
25-
26-
const server = http.createServer(common.mustNotCall((req, res) => {
27-
res.end();
28-
}, 1));
29-
30-
server.listen(0, common.mustSucceed(() => {
31-
const client = net.connect(server.address().port, 'localhost');
32-
33-
let response = '';
34-
35-
// Verify that the server listener is never called
36-
37-
client.on('data', common.mustCall((chunk) => {
38-
response += chunk;
9+
{
10+
const msg = [
11+
'POST / HTTP/1.1',
12+
'Host: 127.0.0.1',
13+
'Transfer-Encoding: chunked',
14+
'Transfer-Encoding: chunked-false',
15+
'Connection: upgrade',
16+
'',
17+
'1',
18+
'A',
19+
'0',
20+
'',
21+
'GET /flag HTTP/1.1',
22+
'Host: 127.0.0.1',
23+
'',
24+
'',
25+
].join('\r\n');
26+
27+
const server = http.createServer(common.mustNotCall((req, res) => {
28+
res.end();
29+
}, 1));
30+
31+
server.listen(0, common.mustSucceed(() => {
32+
const client = net.connect(server.address().port, 'localhost');
33+
34+
let response = '';
35+
36+
// Verify that the server listener is never called
37+
38+
client.on('data', common.mustCall((chunk) => {
39+
response += chunk;
40+
}));
41+
42+
client.setEncoding('utf8');
43+
client.on('error', common.mustNotCall());
44+
client.on('end', common.mustCall(() => {
45+
assert.strictEqual(
46+
response,
47+
'HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n'
48+
);
49+
server.close();
50+
}));
51+
client.write(msg);
52+
client.resume();
3953
}));
54+
}
55+
56+
{
57+
const msg = [
58+
'POST / HTTP/1.1',
59+
'Host: 127.0.0.1',
60+
'Transfer-Encoding: chunked',
61+
' , chunked-false',
62+
'Connection: upgrade',
63+
'',
64+
'1',
65+
'A',
66+
'0',
67+
'',
68+
'GET /flag HTTP/1.1',
69+
'Host: 127.0.0.1',
70+
'',
71+
'',
72+
].join('\r\n');
73+
74+
const server = http.createServer(common.mustCall((request, response) => {
75+
assert.notStrictEqual(request.url, '/admin');
76+
response.end('hello world');
77+
}), 1);
78+
79+
server.listen(0, common.mustSucceed(() => {
80+
const client = net.connect(server.address().port, 'localhost');
81+
82+
client.on('end', common.mustCall(function() {
83+
server.close();
84+
}));
4085

41-
client.setEncoding('utf8');
42-
client.on('error', common.mustNotCall());
43-
client.on('end', common.mustCall(() => {
44-
assert.strictEqual(
45-
response,
46-
'HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n'
47-
);
48-
server.close();
86+
client.write(msg);
87+
client.resume();
4988
}));
50-
client.write(msg);
51-
client.resume();
52-
}));
89+
}

0 commit comments

Comments
 (0)
Please sign in to comment.