node/test/parallel/test-http-client-unescaped-...

'use strict';
const common = require('../common');
const assert = require('assert');
const http = require('http');

for (let i = 0; i <= 32; i += 1) {
  const path = 'bad' + String.fromCharCode(i) + 'path';
  assert.throws(() => http.get({ path }, common.mustNotCall()),
                /contains unescaped characters/);
}
test: enable linting for tests Enable linting for the test directory. A number of changes was made so all tests conform the current rules used by lib and src directories. The only exception for tests is that unreachable (dead) code is allowed. test-fs-non-number-arguments-throw had to be excluded from the changes because of a weird issue on Windows CI. PR-URL: https://github.com/nodejs/io.js/pull/1721 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> 10 years ago			`'use strict';`
http: reject control characters in http.request() Unsanitized paths containing line feed characters can be used for header injection and request splitting so reject them with an exception. There seems to be no reasonable use case for allowing control characters (characters <= 31) while there are several scenarios where they can be used to exploit software bugs so reject control characters altogether. PR-URL: https://github.com/nodejs/node/pull/8923 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Evan Lucas <evanlucas@me.com> Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: not-an-aardvark <not-an-aardvark@users.noreply.github.com> 8 years ago			`const common = require('../common');`
			`const assert = require('assert');`
			`const http = require('http');`
http: escape unsafe characters in request path Make http.request() and friends escape unsafe characters in the request path. That is, a request for '/foo bar' is now escaped as '/foo%20bar'. Before this commit, the path was used as-is in the request status line, creating an invalid HTTP request ("GET /foo bar HTTP/1.1"). Fixes #4381. 12 years ago
test: simplify test-http-client-unescaped-path PR-URL: https://github.com/nodejs/node/pull/9649 Reviewed-By: Trevor Norris <trev.norris@gmail.com> Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> 8 years ago			`for (let i = 0; i <= 32; i += 1) {`
			`const path = 'bad' + String.fromCharCode(i) + 'path';`
test: add common.mustNotCall() This commit adds a mustNotCall() helper for testing. This provides an alternative to using common.fail() as a callback, or creating a callback function for the sole purpose of calling common.fail(). PR-URL: https://github.com/nodejs/node/pull/11152 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Yuta Hiroto <hello@about-hiroppy.com> 8 years ago			`assert.throws(() => http.get({ path }, common.mustNotCall()),`
http: reject control characters in http.request() Unsanitized paths containing line feed characters can be used for header injection and request splitting so reject them with an exception. There seems to be no reasonable use case for allowing control characters (characters <= 31) while there are several scenarios where they can be used to exploit software bugs so reject control characters altogether. PR-URL: https://github.com/nodejs/node/pull/8923 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Evan Lucas <evanlucas@me.com> Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: not-an-aardvark <not-an-aardvark@users.noreply.github.com> 8 years ago			`/contains unescaped characters/);`
			`}`