mirror of
https://github.com/nodejs/node.git
synced 2026-11-09 15:11:11 -05:00
Matteo Collina
21436f0405
Makes IncomingMessage.prototype.headers and trailers have a null prototype, matching the existing behavior of headersDistinct and trailersDistinct. Fixes prototype pollution concerns where headers like __proto__ could be interpreted as prototype manipulation. Refs: https://github.com/nodejs/node/issues/61771 PR-URL: https://github.com/nodejs/node/pull/62900 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
75 lines
2.0 KiB
JavaScript
75 lines
2.0 KiB
JavaScript
'use strict';
|
|
|
|
const common = require('../common');
|
|
if (!common.hasCrypto)
|
|
common.skip('missing crypto');
|
|
const assert = require('assert');
|
|
const h2 = require('http2');
|
|
|
|
// Http2ServerRequest should have getter for trailers & rawTrailers
|
|
|
|
const expectedTrailers = {
|
|
'x-foo': 'xOxOxOx, OxOxOxO, xOxOxOx, OxOxOxO',
|
|
'x-foo-test': 'test, test'
|
|
};
|
|
|
|
const server = h2.createServer();
|
|
server.listen(0, common.mustCall(function() {
|
|
const port = server.address().port;
|
|
server.once('request', common.mustCall(function(request, response) {
|
|
let data = '';
|
|
request.setEncoding('utf8');
|
|
request.on('data', common.mustCallAtLeast((chunk) => data += chunk));
|
|
request.on('end', common.mustCall(() => {
|
|
const trailers = request.trailers;
|
|
assert.strictEqual(Object.getPrototypeOf(trailers), null);
|
|
for (const [name, value] of Object.entries(expectedTrailers)) {
|
|
assert.strictEqual(trailers[name], value);
|
|
}
|
|
assert.deepStrictEqual([
|
|
'x-foo',
|
|
'xOxOxOx',
|
|
'x-foo',
|
|
'OxOxOxO',
|
|
'x-foo',
|
|
'xOxOxOx',
|
|
'x-foo',
|
|
'OxOxOxO',
|
|
'x-foo-test',
|
|
'test, test',
|
|
], request.rawTrailers);
|
|
assert.strictEqual(data, 'test\ntest');
|
|
response.end();
|
|
}));
|
|
}));
|
|
|
|
const url = `http://localhost:${port}`;
|
|
const client = h2.connect(url, common.mustCall(function() {
|
|
const headers = {
|
|
':path': '/foobar',
|
|
':method': 'POST',
|
|
':scheme': 'http',
|
|
':authority': `localhost:${port}`
|
|
};
|
|
const request = client.request(headers, { waitForTrailers: true });
|
|
|
|
request.on('wantTrailers', () => {
|
|
request.sendTrailers({
|
|
'x-fOo': 'xOxOxOx',
|
|
'x-foO': 'OxOxOxO',
|
|
'X-fOo': 'xOxOxOx',
|
|
'X-foO': 'OxOxOxO',
|
|
'x-foo-test': 'test, test'
|
|
});
|
|
});
|
|
|
|
request.resume();
|
|
request.on('end', common.mustCall(function() {
|
|
server.close();
|
|
client.close();
|
|
}));
|
|
request.write('test\n');
|
|
request.end('test');
|
|
}));
|
|
}));
|