Unverified Commit b961d9fd authored by Benno Fünfstück's avatar Benno Fünfstück Committed by Ruben Bridgewater
Browse files

http: disallow two-byte characters in URL path

This commit changes node's handling of two-byte characters in
the path component of an http URL. Previously, node would just
strip the higher byte when generating the request. So this code:

```
http.request({host: "example.com", port: "80", "/N"})
```

would request `http://example.com/.`
(`.` is the character for the byte `0x2e`).

This is not useful and can in some cases lead to filter evasion.
With this change, the code generates `ERR_UNESCAPED_CHARACTERS`,
just like space and control characters already did.

PR-URL: https://github.com/nodejs/node/pull/16237


Reviewed-By: default avatarJames M Snell <jasnell@gmail.com>
Reviewed-By: default avatarAnna Henningsen <anna@addaleax.net>
Reviewed-By: default avatarAnatoli Papirovski <apapirovski@mac.com>
Reviewed-By: default avatarRuben Bridgewater <ruben@bridgewater.de>
Reviewed-By: default avatarTimothy Gu <timothygu99@gmail.com>
parent ac25cee2
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment