GeezerVison is showing github.com — net: validate host name for server listen · nodejs/node@52322aa
File treeExpand file treeCollapse file tree Open diff view settings Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: lib/net.js +8Lines changed: 8 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -35,6 +35,8 @@ const { | 35 | 35 | NumberParseInt, | 36 | 36 | ObjectDefineProperty, | 37 | 37 | ObjectSetPrototypeOf, | | 38 | + RegExp, | | 39 | + RegExpPrototypeExec, | 38 | 40 | Symbol, | 39 | 41 | SymbolAsyncDispose, | 40 | 42 | SymbolDispose, | @@ -143,6 +145,8 @@ const { kTimeout } = require('internal/timers'); | 143 | 145 | const DEFAULT_IPV4_ADDR = '0.0.0.0'; | 144 | 146 | const DEFAULT_IPV6_ADDR = '::'; | 145 | 147 |
| | 148 | +const HOST_REGEXP = new RegExp('^[a-zA-Z0-9-:%.]+$'); | | 149 | + | 146 | 150 | const noop = () => {}; | 147 | 151 |
| 148 | 152 | const kPerfHooksNetConnectContext = Symbol('kPerfHooksNetConnectContext'); | @@ -2020,6 +2024,10 @@ Server.prototype.listen = function(...args) { | 2020 | 2024 | toNumber(args.length > 2 && args[2]); // (port, host, backlog) | 2021 | 2025 |
| 2022 | 2026 | options = options._handle || options.handle || options; | | 2027 | + if (typeof options.host === 'string' && RegExpPrototypeExec(HOST_REGEXP, options.host) === null) { | | 2028 | + throw new ERR_INVALID_ARG_VALUE('host', options.host); | | 2029 | + } | | 2030 | + | 2023 | 2031 | const flags = getFlags(options.ipv6Only); | 2024 | 2032 | // Refresh the id to make the previous call invalid | 2025 | 2033 | this._listeningId++; | |
Collapse file Copy file name to clipboardExpand all lines: test/parallel/test-net-server-listen-options.js +12Lines changed: 12 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -15,6 +15,10 @@ function close() { this.close(); } | 15 | 15 | // Test listen({port}) | 16 | 16 | net.createServer().listen({ port: 0 }) | 17 | 17 | .on('listening', common.mustCall(close)); | | 18 | + // Test listen(host, port}) on ipv4 | | 19 | + net.createServer().listen({ host: '127.0.0.1', port: '3000' }).on('listening', common.mustCall(close)); | | 20 | + // Test listen(host, port}) on ipv6 | | 21 | + net.createServer().listen({ host: '::', port: '3001' }).on('listening', common.mustCall(close)); | 18 | 22 | } | 19 | 23 |
| 20 | 24 | // Test listen(port, cb) and listen({ port }, cb) combinations | @@ -66,6 +70,13 @@ const listenOnPort = [ | 66 | 70 | name: 'TypeError', | 67 | 71 | message: /^The argument 'options' must have the property "port" or "path"\. Received .+$/, | 68 | 72 | }); | | 73 | + } else if (typeof options.host === 'string' && !options.host.match(/^[a-zA-Z0-9-:%.]+$/)) { | | 74 | + assert.throws(fn, | | 75 | + { | | 76 | + code: 'ERR_INVALID_ARG_VALUE', | | 77 | + name: 'TypeError', | | 78 | + message: /^The argument 'host' is invalid\. Received .+$/, | | 79 | + }); | 69 | 80 | } else { | 70 | 81 | assert.throws(fn, | 71 | 82 | { | @@ -91,4 +102,5 @@ const listenOnPort = [ | 91 | 102 | shouldFailToListen({ host: 'localhost:3000' }); | 92 | 103 | shouldFailToListen({ host: { port: 3000 } }); | 93 | 104 | shouldFailToListen({ exclusive: true }); | | 105 | + shouldFailToListen({ host: '[::]', port: 3000 }); | 94 | 106 | } |
|