deps: reject interior blanks in Content-Length
Original commit message follows:
Before this commit `Content-Length: 4 2` was accepted as a valid
header and recorded as `parser->content_length = 42`. Now it is
a parse error that fails with error `HPE_INVALID_CONTENT_LENGTH`.
Downstream users that inspect `parser->content_length` and naively
parse the string value using `strtoul()` might get confused by the
discrepancy between the two values. Resolve that by simply not
letting it happen.
Fixes: https://github.com/nodejs-private/security/issues/178
PR-URL: https://github.com/nodejs-private/http-parser-private/pull/1
Reviewed-By:
Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By:
Colin Ihrig <cjihrig@gmail.com>
Reviewed-By:
Evan Lucas <evanlucas@me.com>
Reviewed-By:
Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By:
James M Snell <jasnell@gmail.com>
Reviewed-By:
Rod Vagg <rod@vagg.org>
parent
7ebc9981
Please register or sign in to comment