GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — http2: validate non-link headers in writeEarlyHints · nodejs/node@f712e68

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • lib/internal/http2
    • compat.js
  • test/parallel
    • test-http2-compat-write-early-hints-invalid-header.js
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎lib/internal/http2/compat.js‎

Copy file name to clipboardExpand all lines: lib/internal/http2/compat.js
+5-1Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -921,7 +921,11 @@ class Http2ServerResponse extends Stream {
921921

922922
for (const key of ObjectKeys(hints)) {
923923
if (key !== 'link') {
924-
headers[key] = hints[key];
924+
const name = key.trim().toLowerCase();
925+
assertValidHeader(name, hints[key]);
926+
if (!checkIsHttpToken(name))
927+
throw new ERR_INVALID_HTTP_TOKEN('Header name', name);
928+
headers[name] = hints[key];
925929
}
926930
}
927931

Collapse file

‎test/parallel/test-http2-compat-write-early-hints-invalid-header.js‎

Copy file name to clipboard
+60Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
'use strict';
2+
3+
const common = require('../common');
4+
if (!common.hasCrypto) common.skip('missing crypto');
5+
6+
const assert = require('node:assert');
7+
const http2 = require('node:http2');
8+
const debug = require('node:util').debuglog('test');
9+
10+
const testResBody = 'response content';
11+
12+
{
13+
const server = http2.createServer();
14+
15+
server.on('request', common.mustCall((req, res) => {
16+
debug('Server sending early hints...');
17+
18+
assert.throws(() => {
19+
res.writeEarlyHints({
20+
'link': '</styles.css>; rel=preload; as=style',
21+
'x\rbad': 'value',
22+
});
23+
}, (err) => err.code === 'ERR_INVALID_HTTP_TOKEN');
24+
25+
assert.throws(() => {
26+
res.writeEarlyHints({
27+
'link': '</styles.css>; rel=preload; as=style',
28+
'x-custom': undefined,
29+
});
30+
}, (err) => err.code === 'ERR_HTTP2_INVALID_HEADER_VALUE');
31+
32+
debug('Server sending full response...');
33+
res.end(testResBody);
34+
}));
35+
36+
server.listen(0);
37+
38+
server.on('listening', common.mustCall(() => {
39+
const client = http2.connect(`http://localhost:${server.address().port}`);
40+
const req = client.request();
41+
42+
debug('Client sending request...');
43+
44+
req.on('headers', common.mustNotCall());
45+
46+
req.on('response', common.mustCall((headers) => {
47+
assert.strictEqual(headers[':status'], 200);
48+
}));
49+
50+
let data = '';
51+
req.on('data', common.mustCallAtLeast((d) => data += d));
52+
53+
req.on('end', common.mustCall(() => {
54+
debug('Got full response.');
55+
assert.strictEqual(data, testResBody);
56+
client.close();
57+
server.close();
58+
}));
59+
}));
60+
}

0 commit comments

Comments
0 (0)
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.