21436f0405Makes IncomingMessage.prototype.headers and trailers have a null prototype, matching the existing behavior of headersDistinct and trailersDistinct. Fixes prototype pollution concerns where headers like __proto__ could be interpreted as prototype manipulation. Refs: https://github.com/nodejs/node/issues/61771 PR-URL: https://github.com/nodejs/node/pull/62900 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
69 lines
2 KiB
JavaScript
69 lines
2 KiB
JavaScript
'use strict';
|
|
|
|
const common = require('../common');
|
|
|
|
const assert = require('assert');
|
|
const http = require('http');
|
|
|
|
function execute(options) {
|
|
http.createServer(common.mustCall(function(req, res) {
|
|
const expectHeaders = { '__proto__': null,
|
|
'x-foo': 'boom',
|
|
'cookie': 'a=1; b=2; c=3',
|
|
'connection': 'keep-alive',
|
|
'host': 'example.com' };
|
|
|
|
// no Host header when you set headers an array
|
|
if (!Array.isArray(options.headers)) {
|
|
expectHeaders.host = `localhost:${this.address().port}`;
|
|
}
|
|
|
|
// no Authorization header when you set headers an array
|
|
if (options.auth && !Array.isArray(options.headers)) {
|
|
expectHeaders.authorization =
|
|
`Basic ${Buffer.from(options.auth).toString('base64')}`;
|
|
}
|
|
|
|
this.close();
|
|
|
|
assert.deepStrictEqual(req.headers, expectHeaders);
|
|
|
|
res.writeHead(200, { 'Connection': 'close' });
|
|
res.end();
|
|
})).listen(0, function() {
|
|
options = Object.assign(options, {
|
|
port: this.address().port,
|
|
path: '/'
|
|
});
|
|
const req = http.request(options);
|
|
req.end();
|
|
});
|
|
}
|
|
|
|
// Should be the same except for implicit Host header on the first two
|
|
execute({ headers: { 'x-foo': 'boom', 'cookie': 'a=1; b=2; c=3' } });
|
|
execute({ headers: { 'x-foo': 'boom', 'cookie': [ 'a=1', 'b=2', 'c=3' ] } });
|
|
execute({ headers: [
|
|
[ 'x-foo', 'boom' ],
|
|
[ 'cookie', 'a=1; b=2; c=3' ],
|
|
[ 'Host', 'example.com' ],
|
|
] });
|
|
execute({ headers: [
|
|
[ 'x-foo', 'boom' ],
|
|
[ 'cookie', [ 'a=1', 'b=2', 'c=3' ]],
|
|
[ 'Host', 'example.com' ],
|
|
] });
|
|
execute({ headers: [
|
|
[ 'x-foo', 'boom' ], [ 'cookie', 'a=1' ],
|
|
[ 'cookie', 'b=2' ], [ 'cookie', 'c=3' ],
|
|
[ 'Host', 'example.com'],
|
|
] });
|
|
|
|
// Authorization and Host header both missing from the second
|
|
execute({ auth: 'foo:bar', headers:
|
|
{ 'x-foo': 'boom', 'cookie': 'a=1; b=2; c=3' } });
|
|
execute({ auth: 'foo:bar', headers: [
|
|
[ 'x-foo', 'boom' ], [ 'cookie', 'a=1' ],
|
|
[ 'cookie', 'b=2' ], [ 'cookie', 'c=3'],
|
|
[ 'Host', 'example.com'],
|
|
] });
|