diff options
author | Richard Lau <rlau@redhat.com> | 2020-11-26 18:50:56 +0300 |
---|---|---|
committer | Richard Lau <rlau@redhat.com> | 2020-12-23 17:15:16 +0300 |
commit | aa6b97fb99d7528649fadb4c6a894e078fe4323c (patch) | |
tree | 7c897f17dac26dfef530594120637be9a779d99c | |
parent | fc70ce08f5818a286fb5899a1bc3aff5965a745e (diff) |
http: add test for http transfer encoding smuggling
Refs: https://github.com/nodejs-private/node-private/pull/228
Refs: https://hackerone.com/bugs?report_id=1002188&subject=nodejs
PR-URL: https://github.com/nodejs-private/node-private/pull/235
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
-rw-r--r-- | test/parallel/test-http-transfer-encoding-smuggling.js | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/test/parallel/test-http-transfer-encoding-smuggling.js b/test/parallel/test-http-transfer-encoding-smuggling.js new file mode 100644 index 00000000000..9d97db4c0a2 --- /dev/null +++ b/test/parallel/test-http-transfer-encoding-smuggling.js @@ -0,0 +1,46 @@ +'use strict'; + +const common = require('../common'); + +const assert = require('assert'); +const http = require('http'); +const net = require('net'); + +const msg = [ + 'POST / HTTP/1.1', + 'Host: 127.0.0.1', + 'Transfer-Encoding: chunked', + 'Transfer-Encoding: chunked-false', + 'Connection: upgrade', + '', + '1', + 'A', + '0', + '', + 'GET /flag HTTP/1.1', + 'Host: 127.0.0.1', + '', + '', +].join('\r\n'); + +// Verify that the server is called only once even with a smuggled request. + +const server = http.createServer(common.mustCall((req, res) => { + res.end(); +}, 1)); + +function send(next) { + const client = net.connect(server.address().port, 'localhost'); + client.setEncoding('utf8'); + client.on('error', common.mustNotCall()); + client.on('end', next); + client.write(msg); + client.resume(); +} + +server.listen(0, common.mustCall((err) => { + assert.ifError(err); + send(common.mustCall(() => { + server.close(); + })); +})); |