Home Original page

http: llhttp opt-in insecure HTTP header parsing by sam-github · Pull Request #30567 · nodejs/node

@nodejs-github-bot added the lib / src

Issues and PRs related to general changes in the lib or src directory.

label

Nov 20, 2019

@addaleax addaleax added http

Issues or PRs related to the http subsystem.

http_parser

Issues and PRs related to the HTTP Parser dependency or the http_parser binding.

semver-minor

PRs that contain new features and should be released in the next minor version.

and removed lib / src

Issues and PRs related to general changes in the lib or src directory.

labels

Nov 20, 2019

addaleax

@addaleax addaleax added the cli

Issues and PRs related to the Node.js command line interface.

label

Nov 20, 2019

addaleax added a commit to addaleax/node that referenced this pull request

Nov 20, 2019 
Make `maxHeaderSize` a.k.a. `--max-header-size` configurable now that
the legacy parser is gone (which only supported a single global value).

Refs: nodejs#30567

@lpinca lpinca added the blocked

PRs that are blocked by other issues or PRs.

label

Nov 21, 2019

mcollina

vsemozhetbyt

sam-github added a commit to sam-github/node that referenced this pull request

Jan 9, 2020 
Test that using --insecure-http-parser will disable validation of
invalid characters in HTTP headers.

See:
- nodejs#30567

sam-github added a commit that referenced this pull request

Jan 9, 2020 
Test that using --insecure-http-parser will disable validation of
invalid characters in HTTP headers.

See:
- #30567

PR-URL: #31253
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

sam-github added a commit to sam-github/node that referenced this pull request

Jan 10, 2020 
Allow insecure HTTP header parsing. Make clear it is insecure.

See:
- nodejs#30553
- nodejs#27711 (comment)
- nodejs#30515

PR-URL: nodejs#30567
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

sam-github added a commit to sam-github/node that referenced this pull request

Jan 10, 2020 
Test that using --insecure-http-parser will disable validation of
invalid characters in HTTP headers.

See:
- nodejs#30567

PR-URL: nodejs#31253
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

sam-github added a commit to sam-github/node that referenced this pull request

Jan 10, 2020 
Allow insecure HTTP header parsing. Make clear it is insecure.

See:
- nodejs#30553
- nodejs#27711 (comment)
- nodejs#30515

PR-URL: nodejs#30567
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

sam-github added a commit to sam-github/node that referenced this pull request

Jan 10, 2020 
Test that using --insecure-http-parser will disable validation of
invalid characters in HTTP headers.

See:
- nodejs#30567

PR-URL: nodejs#31253
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

targos pushed a commit that referenced this pull request

Jan 14, 2020 
Allow insecure HTTP header parsing. Make clear it is insecure.

See:
- #30553
- #27711 (comment)
- #30515

PR-URL: #30567
Backport-PR-URL: #30473
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

targos pushed a commit that referenced this pull request

Jan 14, 2020 
Test that using --insecure-http-parser will disable validation of
invalid characters in HTTP headers.

See:
- #30567

PR-URL: #31253
Backport-PR-URL: #30473
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

MylesBorins pushed a commit that referenced this pull request

Jan 16, 2020 
Test that using --insecure-http-parser will disable validation of
invalid characters in HTTP headers.

See:
- #30567

PR-URL: #31253
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

This was referenced

Jan 21, 2020

zsw007 added a commit to ibmruntimes/node that referenced this pull request

Feb 11, 2020

zsw007 added a commit to ibmruntimes/node that referenced this pull request

Feb 11, 2020 
Backport ab1fcb8

Original commit message:

    Test that using --insecure-http-parser will disable validation of
    invalid characters in HTTP headers.

    See:
    - nodejs/node#30567

    PR-URL: nodejs/node#31253
    Backport-PR-URL: nodejs/node#30473
    Reviewed-By: Richard Lau <riclau@uk.ibm.com>
    Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>