lukechilds
/
node
mirror of https://github.com/lukechilds/node.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

http2: expand list of known headers 

Add access-control-*, dnt, forwarded, trailer, tk,
upgrade-insecure-requests, warning, x-content-type-options and
x-frame-options to known list of headers for HTTP2. Expand tests
to account for these headers.

Fixes: https://github.com/nodejs/node/issues/15337
Refs: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
Refs: https://www.w3.org/TR/cors/#syntax
Refs: https://www.w3.org/2011/tracking-protection/drafts/tracking-dnt.html#dnt-header-field
Refs: https://tools.ietf.org/html/rfc7239#section-4
Refs: https://tools.ietf.org/html/rfc7230#section-4.4
Refs: https://www.w3.org/2011/tracking-protection/drafts/tracking-dnt.html#response-header-field
Refs: https://www.w3.org/TR/upgrade-insecure-requests/#preference
Refs: https://tools.ietf.org/html/rfc7234#section-5.5
Refs: https://fetch.spec.whatwg.org/#x-content-type-options-header
Refs: https://tools.ietf.org/html/rfc7034

PR-URL: https://github.com/nodejs/node/pull/15434
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
canary-base
Anatoli Papirovski 8 years ago
committed by James M Snell
parent
873e5bd0b4
commit
2f5bef4705
4 changed files with 79 additions and 3 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 16
      lib/internal/http2/util.js
  2. 15
      src/node_http2.h
  3. 15
      test/parallel/test-http2-binding.js
  4. 36
      test/parallel/test-http2-util-headers-list.js

16
lib/internal/http2/util.js
View File

@ -12,6 +12,9 @@ const {
HTTP2_HEADER_AUTHORITY,
HTTP2_HEADER_SCHEME,
HTTP2_HEADER_PATH,
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
HTTP2_HEADER_ACCESS_CONTROL_MAX_AGE,
HTTP2_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
HTTP2_HEADER_AGE,
HTTP2_HEADER_AUTHORIZATION,
HTTP2_HEADER_CONTENT_ENCODING,
@ -23,6 +26,7 @@ const {
HTTP2_HEADER_CONTENT_TYPE,
HTTP2_HEADER_COOKIE,
HTTP2_HEADER_DATE,
HTTP2_HEADER_DNT,
HTTP2_HEADER_ETAG,
HTTP2_HEADER_EXPIRES,
HTTP2_HEADER_FROM,
@ -39,7 +43,10 @@ const {
HTTP2_HEADER_REFERER,
HTTP2_HEADER_RETRY_AFTER,
HTTP2_HEADER_SET_COOKIE,
HTTP2_HEADER_TK,
HTTP2_HEADER_UPGRADE_INSECURE_REQUESTS,
HTTP2_HEADER_USER_AGENT,
HTTP2_HEADER_X_CONTENT_TYPE_OPTIONS,
HTTP2_HEADER_CONNECTION,
HTTP2_HEADER_UPGRADE,
@ -74,6 +81,9 @@ const kSingleValueHeaders = new Set([
HTTP2_HEADER_AUTHORITY,
HTTP2_HEADER_SCHEME,
HTTP2_HEADER_PATH,
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
HTTP2_HEADER_ACCESS_CONTROL_MAX_AGE,
HTTP2_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
HTTP2_HEADER_AGE,
HTTP2_HEADER_AUTHORIZATION,
HTTP2_HEADER_CONTENT_ENCODING,
@ -84,6 +94,7 @@ const kSingleValueHeaders = new Set([
HTTP2_HEADER_CONTENT_RANGE,
HTTP2_HEADER_CONTENT_TYPE,
HTTP2_HEADER_DATE,
HTTP2_HEADER_DNT,
HTTP2_HEADER_ETAG,
HTTP2_HEADER_EXPIRES,
HTTP2_HEADER_FROM,
@ -99,7 +110,10 @@ const kSingleValueHeaders = new Set([
HTTP2_HEADER_RANGE,
HTTP2_HEADER_REFERER,
HTTP2_HEADER_RETRY_AFTER,
HTTP2_HEADER_USER_AGENT
HTTP2_HEADER_TK,
HTTP2_HEADER_UPGRADE_INSECURE_REQUESTS,
HTTP2_HEADER_USER_AGENT,
HTTP2_HEADER_X_CONTENT_TYPE_OPTIONS
]);
// The HTTP methods in this set are specifically defined as assigning no

15
src/node_http2.h
View File

@ -69,7 +69,14 @@ using v8::MaybeLocal;
V(ACCEPT_LANGUAGE, "accept-language") \
V(ACCEPT_RANGES, "accept-ranges") \
V(ACCEPT, "accept") \
V(ACCESS_CONTROL_ALLOW_CREDENTIALS, "access-control-allow-credentials") \
V(ACCESS_CONTROL_ALLOW_HEADERS, "access-control-allow-headers") \
V(ACCESS_CONTROL_ALLOW_METHODS, "access-control-allow-methods") \
V(ACCESS_CONTROL_ALLOW_ORIGIN, "access-control-allow-origin") \
V(ACCESS_CONTROL_EXPOSE_HEADERS, "access-control-expose-headers") \
V(ACCESS_CONTROL_MAX_AGE, "access-control-max-age") \
V(ACCESS_CONTROL_REQUEST_HEADERS, "access-control-request-headers") \
V(ACCESS_CONTROL_REQUEST_METHOD, "access-control-request-method") \
V(AGE, "age") \
V(ALLOW, "allow") \
V(AUTHORIZATION, "authorization") \
@ -85,9 +92,11 @@ using v8::MaybeLocal;
V(CONTENT_TYPE, "content-type") \
V(COOKIE, "cookie") \
V(DATE, "date") \
V(DNT, "dnt") \
V(ETAG, "etag") \
V(EXPECT, "expect") \
V(EXPIRES, "expires") \
V(FORWARDED, "forwarded") \
V(FROM, "from") \
V(HOST, "host") \
V(IF_MATCH, "if-match") \
@ -109,13 +118,19 @@ using v8::MaybeLocal;
V(SERVER, "server") \
V(SET_COOKIE, "set-cookie") \
V(STRICT_TRANSPORT_SECURITY, "strict-transport-security") \
V(TRAILER, "trailer") \
V(TRANSFER_ENCODING, "transfer-encoding") \
V(TE, "te") \
V(TK, "tk") \
V(UPGRADE_INSECURE_REQUESTS, "upgrade-insecure-requests") \
V(UPGRADE, "upgrade") \
V(USER_AGENT, "user-agent") \
V(VARY, "vary") \
V(VIA, "via") \
V(WARNING, "warning") \
V(WWW_AUTHENTICATE, "www-authenticate") \
V(X_CONTENT_TYPE_OPTIONS, "x-content-type-options") \
V(X_FRAME_OPTIONS, "x-frame-options") \
V(HTTP2_SETTINGS, "http2-settings") \
V(KEEP_ALIVE, "keep-alive") \
V(PROXY_CONNECTION, "proxy-connection")

15
test/parallel/test-http2-binding.js
View File

@ -105,7 +105,14 @@ const expectedHeaderNames = {
HTTP2_HEADER_ACCEPT_LANGUAGE: 'accept-language',
HTTP2_HEADER_ACCEPT_RANGES: 'accept-ranges',
HTTP2_HEADER_ACCEPT: 'accept',
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS: 'access-control-allow-credentials', // eslint-disable-line max-len
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_HEADERS: 'access-control-allow-headers',
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_METHODS: 'access-control-allow-methods',
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN: 'access-control-allow-origin',
HTTP2_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS: 'access-control-expose-headers',
HTTP2_HEADER_ACCESS_CONTROL_MAX_AGE: 'access-control-max-age',
HTTP2_HEADER_ACCESS_CONTROL_REQUEST_HEADERS: 'access-control-request-headers',
HTTP2_HEADER_ACCESS_CONTROL_REQUEST_METHOD: 'access-control-request-method',
HTTP2_HEADER_AGE: 'age',
HTTP2_HEADER_ALLOW: 'allow',
HTTP2_HEADER_AUTHORIZATION: 'authorization',
@ -119,9 +126,11 @@ const expectedHeaderNames = {
HTTP2_HEADER_CONTENT_TYPE: 'content-type',
HTTP2_HEADER_COOKIE: 'cookie',
HTTP2_HEADER_CONNECTION: 'connection',
HTTP2_HEADER_DNT: 'dnt',
HTTP2_HEADER_ETAG: 'etag',
HTTP2_HEADER_EXPECT: 'expect',
HTTP2_HEADER_EXPIRES: 'expires',
HTTP2_HEADER_FORWARDED: 'forwarded',
HTTP2_HEADER_FROM: 'from',
HTTP2_HEADER_HOST: 'host',
HTTP2_HEADER_IF_MATCH: 'if-match',
@ -144,11 +153,17 @@ const expectedHeaderNames = {
HTTP2_HEADER_SERVER: 'server',
HTTP2_HEADER_SET_COOKIE: 'set-cookie',
HTTP2_HEADER_STRICT_TRANSPORT_SECURITY: 'strict-transport-security',
HTTP2_HEADER_TRAILER: 'trailer',
HTTP2_HEADER_TRANSFER_ENCODING: 'transfer-encoding',
HTTP2_HEADER_TK: 'tk',
HTTP2_HEADER_UPGRADE_INSECURE_REQUESTS: 'upgrade-insecure-requests',
HTTP2_HEADER_USER_AGENT: 'user-agent',
HTTP2_HEADER_VARY: 'vary',
HTTP2_HEADER_VIA: 'via',
HTTP2_HEADER_WARNING: 'warning',
HTTP2_HEADER_WWW_AUTHENTICATE: 'www-authenticate',
HTTP2_HEADER_X_CONTENT_TYPE_OPTIONS: 'x-content-type-options',
HTTP2_HEADER_X_FRAME_OPTIONS: 'x-frame-options',
HTTP2_HEADER_KEEP_ALIVE: 'keep-alive',
HTTP2_HEADER_CONTENT_MD5: 'content-md5',
HTTP2_HEADER_TE: 'te',

36
test/parallel/test-http2-util-headers-list.js
View File

@ -14,6 +14,9 @@ const {
HTTP2_HEADER_AUTHORITY,
HTTP2_HEADER_SCHEME,
HTTP2_HEADER_PATH,
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
HTTP2_HEADER_ACCESS_CONTROL_MAX_AGE,
HTTP2_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
HTTP2_HEADER_AGE,
HTTP2_HEADER_AUTHORIZATION,
HTTP2_HEADER_CONTENT_ENCODING,
@ -24,6 +27,7 @@ const {
HTTP2_HEADER_CONTENT_RANGE,
HTTP2_HEADER_CONTENT_TYPE,
HTTP2_HEADER_DATE,
HTTP2_HEADER_DNT,
HTTP2_HEADER_ETAG,
HTTP2_HEADER_EXPIRES,
HTTP2_HEADER_FROM,
@ -33,24 +37,33 @@ const {
HTTP2_HEADER_IF_RANGE,
HTTP2_HEADER_IF_UNMODIFIED_SINCE,
HTTP2_HEADER_LAST_MODIFIED,
HTTP2_HEADER_LOCATION,
HTTP2_HEADER_MAX_FORWARDS,
HTTP2_HEADER_PROXY_AUTHORIZATION,
HTTP2_HEADER_RANGE,
HTTP2_HEADER_REFERER,
HTTP2_HEADER_RETRY_AFTER,
HTTP2_HEADER_TK,
HTTP2_HEADER_UPGRADE_INSECURE_REQUESTS,
HTTP2_HEADER_USER_AGENT,
HTTP2_HEADER_X_CONTENT_TYPE_OPTIONS,
HTTP2_HEADER_ACCEPT_CHARSET,
HTTP2_HEADER_ACCEPT_ENCODING,
HTTP2_HEADER_ACCEPT_LANGUAGE,
HTTP2_HEADER_ACCEPT_RANGES,
HTTP2_HEADER_ACCEPT,
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_HEADERS,
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_METHODS,
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
HTTP2_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS,
HTTP2_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
HTTP2_HEADER_ALLOW,
HTTP2_HEADER_CACHE_CONTROL,
HTTP2_HEADER_CONTENT_DISPOSITION,
HTTP2_HEADER_COOKIE,
HTTP2_HEADER_EXPECT,
HTTP2_HEADER_FORWARDED,
HTTP2_HEADER_LINK,
HTTP2_HEADER_PREFER,
HTTP2_HEADER_PROXY_AUTHENTICATE,
@ -58,9 +71,12 @@ const {
HTTP2_HEADER_SERVER,
HTTP2_HEADER_SET_COOKIE,
HTTP2_HEADER_STRICT_TRANSPORT_SECURITY,
HTTP2_HEADER_TRAILER,
HTTP2_HEADER_VARY,
HTTP2_HEADER_VIA,
HTTP2_HEADER_WARNING,
HTTP2_HEADER_WWW_AUTHENTICATE,
HTTP2_HEADER_X_FRAME_OPTIONS,
HTTP2_HEADER_CONNECTION,
HTTP2_HEADER_UPGRADE,
@ -145,6 +161,9 @@ const {
HTTP2_HEADER_AUTHORITY,
HTTP2_HEADER_SCHEME,
HTTP2_HEADER_PATH,
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
HTTP2_HEADER_ACCESS_CONTROL_MAX_AGE,
HTTP2_HEADER_ACCESS_CONTROL_REQUEST_METHOD,
HTTP2_HEADER_AGE,
HTTP2_HEADER_AUTHORIZATION,
HTTP2_HEADER_CONTENT_ENCODING,
@ -155,6 +174,7 @@ const {
HTTP2_HEADER_CONTENT_RANGE,
HTTP2_HEADER_CONTENT_TYPE,
HTTP2_HEADER_DATE,
HTTP2_HEADER_DNT,
HTTP2_HEADER_ETAG,
HTTP2_HEADER_EXPIRES,
HTTP2_HEADER_FROM,
@ -164,12 +184,16 @@ const {
HTTP2_HEADER_IF_RANGE,
HTTP2_HEADER_IF_UNMODIFIED_SINCE,
HTTP2_HEADER_LAST_MODIFIED,
HTTP2_HEADER_LOCATION,
HTTP2_HEADER_MAX_FORWARDS,
HTTP2_HEADER_PROXY_AUTHORIZATION,
HTTP2_HEADER_RANGE,
HTTP2_HEADER_REFERER,
HTTP2_HEADER_RETRY_AFTER,
HTTP2_HEADER_USER_AGENT
HTTP2_HEADER_TK,
HTTP2_HEADER_UPGRADE_INSECURE_REQUESTS,
HTTP2_HEADER_USER_AGENT,
HTTP2_HEADER_X_CONTENT_TYPE_OPTIONS
].forEach((name) => {
const msg = `Header field "${name}" must have only a single value`;
common.expectsError({
@ -184,12 +208,17 @@ const {
HTTP2_HEADER_ACCEPT_LANGUAGE,
HTTP2_HEADER_ACCEPT_RANGES,
HTTP2_HEADER_ACCEPT,
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_HEADERS,
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_METHODS,
HTTP2_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
HTTP2_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS,
HTTP2_HEADER_ACCESS_CONTROL_REQUEST_HEADERS,
HTTP2_HEADER_ALLOW,
HTTP2_HEADER_CACHE_CONTROL,
HTTP2_HEADER_CONTENT_DISPOSITION,
HTTP2_HEADER_COOKIE,
HTTP2_HEADER_EXPECT,
HTTP2_HEADER_FORWARDED,
HTTP2_HEADER_LINK,
HTTP2_HEADER_PREFER,
HTTP2_HEADER_PROXY_AUTHENTICATE,
@ -197,9 +226,12 @@ const {
HTTP2_HEADER_SERVER,
HTTP2_HEADER_SET_COOKIE,
HTTP2_HEADER_STRICT_TRANSPORT_SECURITY,
HTTP2_HEADER_TRAILER,
HTTP2_HEADER_VARY,
HTTP2_HEADER_VIA,
HTTP2_HEADER_WWW_AUTHENTICATE
HTTP2_HEADER_WARNING,
HTTP2_HEADER_WWW_AUTHENTICATE,
HTTP2_HEADER_X_FRAME_OPTIONS
].forEach((name) => {
assert(!(mapToHeaders({ [name]: [1, 2, 3] }) instanceof Error), name);
});

Write Preview
Loading…
Cancel
Save