Matteo Collina 775ae50221 http: validate ClientRequest path on set ...

The `path` property on `ClientRequest` was only validated at
construction time. Add a getter/setter so that the same
`INVALID_PATH_REGEX` check runs whenever `req.path` is reassigned,
preventing invalid characters from reaching `_implicitHeader()`.

PR-URL: https://github.com/nodejs/node/pull/62030
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

2026-07-19 17:30:47 -05:00

..

assert

…

dns

…

fs

…

inspector

lib: revert to using default derived class constructors

2025-09-20 06:16:14 +00:00

internal

http: validate headers in writeEarlyHints

2026-07-19 17:30:47 -05:00

path

…

readline

lib: revert to using default derived class constructors

2025-09-20 06:16:14 +00:00

stream

…

test

…

timers

…

util

…

_http_agent.js

http: avoid stream listeners on idle agent sockets

2026-06-22 12:22:52 -03:00

_http_client.js

http: validate ClientRequest path on set

2026-07-19 17:30:47 -05:00

_http_common.js

http: fix rawHeaders exceeding maxHeadersCount limit

2026-02-24 08:39:00 +01:00

_http_incoming.js

http: use null prototype for headersDistinct/trailersDistinct

2026-03-22 16:28:36 +01:00

_http_outgoing.js

http: lazy allocate cookies array

2026-02-19 18:46:22 +01:00

_http_server.js

http: validate headers in writeEarlyHints

2026-07-19 17:30:47 -05:00

_stream_duplex.js

…

_stream_passthrough.js

…

_stream_readable.js

…

_stream_transform.js

…

_stream_wrap.js

…

_stream_writable.js

…

_tls_common.js

lib: backport _tls_common and _tls_wrap refactors

2026-03-16 17:29:52 +01:00

_tls_wrap.js

lib: backport _tls_common and _tls_wrap refactors

2026-03-16 17:29:52 +01:00

assert.js

lib: restructure assert to become a class

2025-08-26 11:22:39 +02:00

async_hooks.js

lib: do not modify prototype deprecated asyncResource (encore)

2025-09-20 06:10:44 +00:00

buffer.js

buffer: optimize buffer.concat performance

2026-07-19 17:30:46 -05:00

child_process.js

child_process: remove unsafe array iteration

2025-09-20 03:33:57 +00:00

cluster.js

…

console.js

…

constants.js

…

crypto.js

…

dgram.js

lib: use FastBuffer for empty buffer allocation

2026-02-24 00:36:56 +01:00

diagnostics_channel.js

diagnostics_channel: fix race condition with diagnostics_channel and GC

2025-10-07 17:29:40 +02:00

dns.js

dns,net: reject hostnames with embedded NUL bytes

2026-06-17 19:52:19 +02:00

domain.js

domain: remove deprecated API call

2025-08-26 11:22:39 +02:00

eslint.config_partial.mjs

lib: enforce use of URLParse

2026-02-24 00:37:06 +01:00

events.js

test: ensure removeListener event fires for once() listeners

2026-02-24 08:39:02 +01:00

fs.js

fs: remove duplicate getValidatedPath calls

2026-02-24 08:38:59 +01:00

http2.js

…

http.js

…

https.js

cli: add --use-env-proxy

2025-10-18 20:35:56 +02:00

inspector.js

inspector: initial support for Network.loadNetworkResource

2025-08-04 12:25:23 +02:00

module.js

lib: allow skipping source maps in node_modules

2025-02-06 01:10:44 +01:00

net.js

http: attach error handler to socket synchronously in onSocket

2026-07-19 17:30:42 -05:00

os.js

os: freeze signals constant

2026-02-24 00:37:08 +01:00

path.js

path: refactor path joining logic for clarity and performance

2025-09-20 06:17:29 +00:00

perf_hooks.js

…

process.js

…

punycode.js

lib,src: isInsideNodeModules should test on the first non-internal frame

2026-02-17 15:14:07 +01:00

querystring.js

lib: prefer logical assignment

2024-11-27 11:03:39 -05:00

readline.js

lib: prefer logical assignment

2024-11-27 11:03:39 -05:00

repl.js

repl: add isValidParentheses check before wrap input

2025-10-07 16:07:13 +02:00

sea.js

sea: implement sea.getAssetKeys()

2025-09-20 06:16:51 +00:00

sqlite.js

sqlite: add DatabaseSync.prototype[Symbol.dispose]()

2025-04-17 10:51:46 -03:00

stream.js

…

string_decoder.js

…

sys.js

…

test.js

test_runner: fix lazy test.assert accessor

2026-07-19 17:30:33 -05:00

timers.js

lib: remove redundant destroyHook checks

2026-02-17 19:12:19 +01:00

tls.js

tls: normalize hostname for server identity checks

2026-06-17 19:52:19 +02:00

trace_events.js

…

tty.js

…

url.js

url: replaced slice with at

2025-10-07 17:29:36 +02:00

util.js

lib: fix typo in util.js comment

2026-02-24 08:38:58 +01:00

v8.js

v8: add v8.getCppHeapStatistics() method

2025-04-17 10:51:20 -03:00

vm.js

lib: add validation for options in compileFunction

2025-01-05 12:57:36 -05:00

wasi.js

…

worker_threads.js

worker: add name for worker

2025-09-20 03:32:52 +00:00

zlib.js

lib: use FastBuffer for empty buffer allocation

2026-02-24 00:36:56 +01:00