Skip to content

Commit 74e01d0

Browse files
mcollinarvagg
mcollina
authored and
rvagg
committed
deps,http: http_parser set max header size to 8KB
CVE-2018-12121 PR-URL: nodejs-private/node-private#143 Ref: nodejs-private/security#139 Ref: nodejs-private/http-parser-private#2 Reviewed-By: Anatoli Papirovski <apapirovski@mac.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: Anna Henningsen <anna@addaleax.net>
1 parent 8f191f3 commit 74e01d0

File tree

4 files changed

+162
-8
lines changed

4 files changed

+162
-8
lines changed

‎deps/http_parser/http_parser.gyp

+2-2
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@
5656
'defines': [ 'HTTP_PARSER_STRICT=0' ],
5757
'include_dirs': [ '.' ],
5858
},
59-
'defines': [ 'HTTP_PARSER_STRICT=0' ],
59+
'defines': [ 'HTTP_MAX_HEADER_SIZE=8192', 'HTTP_PARSER_STRICT=0' ],
6060
'sources': [ './http_parser.c', ],
6161
'conditions': [
6262
['OS=="win"', {
@@ -79,7 +79,7 @@
7979
'defines': [ 'HTTP_PARSER_STRICT=1' ],
8080
'include_dirs': [ '.' ],
8181
},
82-
'defines': [ 'HTTP_PARSER_STRICT=1' ],
82+
'defines': [ 'HTTP_MAX_HEADER_SIZE=8192', 'HTTP_PARSER_STRICT=1' ],
8383
'sources': [ './http_parser.c', ],
8484
'conditions': [
8585
['OS=="win"', {

‎test/parallel/test-http-max-headers-count.js

+3-3
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,14 @@ let requests = 0;
2828
let responses = 0;
2929

3030
const headers = {};
31-
const N = 2000;
31+
const N = 100;
3232
for (let i = 0; i < N; ++i) {
3333
headers[`key${i}`] = i;
3434
}
3535

3636
const maxAndExpected = [ // for server
3737
[50, 50],
38-
[1500, 1500],
38+
[1500, 102],
3939
[0, N + 2] // Host and Connection
4040
];
4141
let max = maxAndExpected[requests][0];
@@ -56,7 +56,7 @@ server.maxHeadersCount = max;
5656
server.listen(0, function() {
5757
const maxAndExpected = [ // for client
5858
[20, 20],
59-
[1200, 1200],
59+
[1200, 103],
6060
[0, N + 3] // Connection, Date and Transfer-Encoding
6161
];
6262
doRequest();

‎test/parallel/test-https-max-headers-count.js

+3-3
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,14 @@ let requests = 0;
1717
let responses = 0;
1818

1919
const headers = {};
20-
const N = 2000;
20+
const N = 100;
2121
for (let i = 0; i < N; ++i) {
2222
headers[`key${i}`] = i;
2323
}
2424

2525
const maxAndExpected = [ // for server
2626
[50, 50],
27-
[1500, 1500],
27+
[1500, 102],
2828
[0, N + 2] // Host and Connection
2929
];
3030
let max = maxAndExpected[requests][0];
@@ -45,7 +45,7 @@ server.maxHeadersCount = max;
4545
server.listen(0, common.mustCall(() => {
4646
const maxAndExpected = [ // for client
4747
[20, 20],
48-
[1200, 1200],
48+
[1200, 103],
4949
[0, N + 3] // Connection, Date and Transfer-Encoding
5050
];
5151
const doRequest = common.mustCall(() => {

‎test/sequential/test-http-max-http-headers.js

+154
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
'use strict';
2+
3+
const assert = require('assert');
4+
const common = require('../common');
5+
const http = require('http');
6+
const net = require('net');
7+
const MAX = 8 * 1024; // 8KB
8+
9+
// Verify that we cannot receive more than 8KB of headers.
10+
11+
function once(cb) {
12+
let called = false;
13+
return () => {
14+
if (!called) {
15+
called = true;
16+
cb();
17+
}
18+
};
19+
}
20+
21+
function finished(client, callback) {
22+
'abort error end'.split(' ').forEach((e) => {
23+
client.on(e, once(() => setImmediate(callback)));
24+
});
25+
}
26+
27+
function fillHeaders(headers, currentSize, valid = false) {
28+
// Generate valid headers
29+
if (valid) {
30+
// TODO(mcollina): understand why -9 is needed instead of -1
31+
headers = headers.slice(0, -9);
32+
}
33+
return headers + '\r\n\r\n';
34+
}
35+
36+
const timeout = common.platformTimeout(10);
37+
38+
function writeHeaders(socket, headers) {
39+
const array = [];
40+
41+
// this is off from 1024 so that \r\n does not get split
42+
const chunkSize = 1000;
43+
let last = 0;
44+
45+
for (let i = 0; i < headers.length / chunkSize; i++) {
46+
const current = (i + 1) * chunkSize;
47+
array.push(headers.slice(last, current));
48+
last = current;
49+
}
50+
51+
// safety check we are chunking correctly
52+
assert.strictEqual(array.join(''), headers);
53+
54+
next();
55+
56+
function next() {
57+
if (socket.write(array.shift())) {
58+
if (array.length === 0) {
59+
socket.end();
60+
} else {
61+
setTimeout(next, timeout);
62+
}
63+
} else {
64+
socket.once('drain', next);
65+
}
66+
}
67+
}
68+
69+
function test1() {
70+
let headers =
71+
'HTTP/1.1 200 OK\r\n' +
72+
'Content-Length: 0\r\n' +
73+
'X-CRASH: ';
74+
75+
// OK, Content-Length, 0, X-CRASH, aaa...
76+
const currentSize = 2 + 14 + 1 + 7;
77+
headers = fillHeaders(headers, currentSize);
78+
79+
const server = net.createServer((sock) => {
80+
sock.once('data', (chunk) => {
81+
writeHeaders(sock, headers);
82+
sock.resume();
83+
});
84+
});
85+
86+
server.listen(0, common.mustCall(() => {
87+
const port = server.address().port;
88+
const client = http.get({ port: port }, common.mustNotCall(() => {}));
89+
90+
client.on('error', common.mustCall((err) => {
91+
assert.strictEqual(err.code, 'HPE_HEADER_OVERFLOW');
92+
server.close();
93+
setImmediate(test2);
94+
}));
95+
}));
96+
}
97+
98+
const test2 = common.mustCall(() => {
99+
let headers =
100+
'GET / HTTP/1.1\r\n' +
101+
'Host: localhost\r\n' +
102+
'Agent: node\r\n' +
103+
'X-CRASH: ';
104+
105+
// /, Host, localhost, Agent, node, X-CRASH, a...
106+
const currentSize = 1 + 4 + 9 + 5 + 4 + 7;
107+
headers = fillHeaders(headers, currentSize);
108+
109+
const server = http.createServer(common.mustNotCall());
110+
111+
server.on('clientError', common.mustCall((err) => {
112+
assert.strictEqual(err.code, 'HPE_HEADER_OVERFLOW');
113+
}));
114+
115+
server.listen(0, common.mustCall(() => {
116+
const client = net.connect(server.address().port);
117+
client.on('connect', () => {
118+
writeHeaders(client, headers);
119+
client.resume();
120+
});
121+
122+
finished(client, common.mustCall((err) => {
123+
server.close();
124+
setImmediate(test3);
125+
}));
126+
}));
127+
});
128+
129+
const test3 = common.mustCall(() => {
130+
let headers =
131+
'GET / HTTP/1.1\r\n' +
132+
'Host: localhost\r\n' +
133+
'Agent: node\r\n' +
134+
'X-CRASH: ';
135+
136+
// /, Host, localhost, Agent, node, X-CRASH, a...
137+
const currentSize = 1 + 4 + 9 + 5 + 4 + 7;
138+
headers = fillHeaders(headers, currentSize, true);
139+
140+
const server = http.createServer(common.mustCall((req, res) => {
141+
res.end('hello world');
142+
setImmediate(server.close.bind(server));
143+
}));
144+
145+
server.listen(0, common.mustCall(() => {
146+
const client = net.connect(server.address().port);
147+
client.on('connect', () => {
148+
writeHeaders(client, headers);
149+
client.resume();
150+
});
151+
}));
152+
});
153+
154+
test1();

0 commit comments

Comments
 (0)