lukechilds
/
node
mirror of https://github.com/lukechilds/node.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
16543 Commits
131 Branches
446 Tags
325 MiB
Tree: d3c85a4806
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'd3c85a4806'
${ noResults }
node/test/parallel/test-http-client-unescaped-...

11 lines
333 B
Raw Normal View History

test: enable linting for tests Enable linting for the test directory. A number of changes was made so all tests conform the current rules used by lib and src directories. The only exception for tests is that unreachable (dead) code is allowed. test-fs-non-number-arguments-throw had to be excluded from the changes because of a weird issue on Windows CI. PR-URL: https://github.com/nodejs/io.js/pull/1721 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
10 years ago
'use strict';
http: reject control characters in http.request() Unsanitized paths containing line feed characters can be used for header injection and request splitting so reject them with an exception. There seems to be no reasonable use case for allowing control characters (characters <= 31) while there are several scenarios where they can be used to exploit software bugs so reject control characters altogether. PR-URL: https://github.com/nodejs/node/pull/8923 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Evan Lucas <evanlucas@me.com> Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: not-an-aardvark <not-an-aardvark@users.noreply.github.com>
9 years ago
const common = require('../common');
const assert = require('assert');
const http = require('http');
http: escape unsafe characters in request path Make http.request() and friends escape unsafe characters in the request path. That is, a request for '/foo bar' is now escaped as '/foo%20bar'. Before this commit, the path was used as-is in the request status line, creating an invalid HTTP request ("GET /foo bar HTTP/1.1"). Fixes #4381.
12 years ago
test: fix RegExp nits * Remove needless RegExp flag In fixed case, `/g` flag is needless in the boolean context. * Remove needless RegExp capturing Use non-capturing grouping or remove capturing completely when: * capturing is useless per se, e.g. in test() check; * captured groups are not used afterward at all; * some of the later captured groups are not used afterward. * Use test, not match/exec in boolean context match() and exec() return a complicated object, unneeded in a boolean context. * Do not needlessly repeat RegExp creation This commit takes RegExp creation out of cycles and other repetitions. As long as the RegExp does not use /g flag and match indices, we are safe here. In tests, this fix hardly gives a significant performance gain, but it increases clarity and maintainability, reassuring some RegExps to be identical. RegExp in functions are not taken out of their functions: while these functions are called many times and their RegExps are recreated with each call, the performance gain in test cases does not seem to be worth decreasing function self-dependency. Backport-PR-URL: https://github.com/nodejs/node/pull/14370 PR-URL: https://github.com/nodejs/node/pull/13770 Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
8 years ago
const errMessage = /contains unescaped characters/;
test: simplify test-http-client-unescaped-path PR-URL: https://github.com/nodejs/node/pull/9649 Reviewed-By: Trevor Norris <trev.norris@gmail.com> Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
8 years ago
for (let i = 0; i <= 32; i += 1) {
test: reduce string concatenations Backport-PR-URL: https://github.com/nodejs/node/pull/13835 PR-URL: https://github.com/nodejs/node/pull/12735 Refs: https://github.com/nodejs/node/pull/12455 Reviewed-By: Refael Ackermann &lt;refack@gmail.com&gt; Reviewed-By: Gibson Fahnestock &lt;gibfahn@gmail.com&gt;
8 years ago
const path = `bad${String.fromCharCode(i)}path`;
test: fix RegExp nits * Remove needless RegExp flag In fixed case, `/g` flag is needless in the boolean context. * Remove needless RegExp capturing Use non-capturing grouping or remove capturing completely when: * capturing is useless per se, e.g. in test() check; * captured groups are not used afterward at all; * some of the later captured groups are not used afterward. * Use test, not match/exec in boolean context match() and exec() return a complicated object, unneeded in a boolean context. * Do not needlessly repeat RegExp creation This commit takes RegExp creation out of cycles and other repetitions. As long as the RegExp does not use /g flag and match indices, we are safe here. In tests, this fix hardly gives a significant performance gain, but it increases clarity and maintainability, reassuring some RegExps to be identical. RegExp in functions are not taken out of their functions: while these functions are called many times and their RegExps are recreated with each call, the performance gain in test cases does not seem to be worth decreasing function self-dependency. Backport-PR-URL: https://github.com/nodejs/node/pull/14370 PR-URL: https://github.com/nodejs/node/pull/13770 Reviewed-By: Colin Ihrig &lt;cjihrig@gmail.com&gt;
8 years ago
assert.throws(() => http.get({ path }, common.mustNotCall()), errMessage);
http: reject control characters in http.request() Unsanitized paths containing line feed characters can be used for header injection and request splitting so reject them with an exception. There seems to be no reasonable use case for allowing control characters (characters &lt;= 31) while there are several scenarios where they can be used to exploit software bugs so reject control characters altogether. PR-URL: https://github.com/nodejs/node/pull/8923 Reviewed-By: Anna Henningsen &lt;anna@addaleax.net&gt; Reviewed-By: Evan Lucas &lt;evanlucas@me.com&gt; Reviewed-By: Fedor Indutny &lt;fedor@indutny.com&gt; Reviewed-By: James M Snell &lt;jasnell@gmail.com&gt; Reviewed-By: Luigi Pinca &lt;luigipinca@gmail.com&gt; Reviewed-By: not-an-aardvark &lt;not-an-aardvark@users.noreply.github.com&gt;
9 years ago
}