Commit 811b63c7 authored by Benno Fünfstück's avatar Benno Fünfstück Committed by Rod Vagg
Browse files

http: disallow two-byte characters in URL path

CVE-2018-12116
Backport of b961d9fd to 6.x

Original commit:
  This commit changes node's handling of two-byte characters in
  the path component of an http URL. Previously, node would just
  strip the higher byte when generating the request. So this code:

  ```
  http.request({host: "example.com", port: "80", "/N"})
  ```

  would request `http://example.com/.`
  (`.` is the character for the byte `0x2e`).

  This is not useful and can in some cases lead to filter evasion.
  With this change, the code generates `ERR_UNESCAPED_CHARACTERS`,
  just like space and control characters already did.

  PR-URL: https://github.com/nodejs/node/pull/16237


Reviewed-By: default avatarJames M Snell <jasnell@gmail.com>
Reviewed-By: default avatarAnna Henningsen <anna@addaleax.net>
Reviewed-By: default avatarAnatoli Papirovski <apapirovski@mac.com>
Reviewed-By: default avatarRuben Bridgewater <ruben@bridgewater.de>
Reviewed-By: default avatarTimothy Gu <timothygu99@gmail.com>

PR-URL: https://github.com/nodejs-private/node-private/pull/146
Fixes: https://github.com/nodejs-private/security/issues/207


Reviewed-By: default avatarMichael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: default avatarJames M Snell <jasnell@gmail.com>
Reviewed-By: default avatarSakthipriyan Vairamani <thechargingvolcano@gmail.com>
Reviewed-By: default avatarAnna Henningsen <anna@addaleax.net>
Reviewed-By: default avatarTimothy Gu <timothygu99@gmail.com>
Reviewed-By: default avatarRuben Bridgewater <ruben@bridgewater.de>
parent 9c268d04
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment