http: disallow two-byte characters in URL path
CVE-2018-12116 Backport of b961d9fd to 6.x Original commit: This commit changes node's handling of two-byte characters in the path component of an http URL. Previously, node would just strip the higher byte when generating the request. So this code: ``` http.request({host: "example.com", port: "80", "/N"}) ``` would request `http://example.com/.` (`.` is the character for the byte `0x2e`). This is not useful and can in some cases lead to filter evasion. With this change, the code generates `ERR_UNESCAPED_CHARACTERS`, just like space and control characters already did. PR-URL: https://github.com/nodejs/node/pull/16237 Reviewed-By:James M Snell <jasnell@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
Timothy Gu <timothygu99@gmail.com> PR-URL: https://github.com/nodejs-private/node-private/pull/146 Fixes: https://github.com/nodejs-private/security/issues/207 Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Timothy Gu <timothygu99@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de>
parent
9c268d04
Please register or sign in to comment