|
| 1 | +'use strict'; |
| 2 | + |
| 3 | +const common = require('../common'); |
| 4 | +const assert = require('assert'); |
| 5 | +const { HTTPParser } = require('_http_common'); |
| 6 | + |
| 7 | +const { REQUEST, RESPONSE } = HTTPParser; |
| 8 | +const kOnHeaders = HTTPParser.kOnHeaders | 0; |
| 9 | +const kOnHeadersComplete = HTTPParser.kOnHeadersComplete | 0; |
| 10 | +const kOnBody = HTTPParser.kOnBody | 0; |
| 11 | +const kOnMessageComplete = HTTPParser.kOnMessageComplete | 0; |
| 12 | + |
| 13 | +function createParser(type, ...initArgs) { |
| 14 | + const parser = new HTTPParser(); |
| 15 | + parser.initialize(type, {}, ...initArgs); |
| 16 | + parser[kOnHeaders] = () => {}; |
| 17 | + parser[kOnHeadersComplete] = () => {}; |
| 18 | + parser[kOnBody] = () => {}; |
| 19 | + parser[kOnMessageComplete] = () => {}; |
| 20 | + return parser; |
| 21 | +} |
| 22 | + |
| 23 | +function assertOverflow(result) { |
| 24 | + assert.ok(result instanceof Error); |
| 25 | + assert.strictEqual(result.code, 'HPE_HEADER_OVERFLOW'); |
| 26 | +} |
| 27 | + |
| 28 | +const twoHeaders = 'X-A: a\r\nX-B: b\r\n'; |
| 29 | +const threeHeaders = 'X-A: a\r\nX-B: b\r\nX-C: c\r\n'; |
| 30 | + |
| 31 | +// The limit passed to initialize() applies to requests and responses. |
| 32 | +for (const [type, startLine] of [ |
| 33 | + [REQUEST, 'GET / HTTP/1.1\r\n'], |
| 34 | + [RESPONSE, 'HTTP/1.1 200 OK\r\nContent-Length: 0\r\n'], |
| 35 | +]) { |
| 36 | + // The response start line carries one header of its own. |
| 37 | + const limit = type === REQUEST ? 4 : 6; |
| 38 | + |
| 39 | + const ok = Buffer.from(`${startLine}${twoHeaders}\r\n`); |
| 40 | + const parser = createParser(type, 0, 0, undefined, limit); |
| 41 | + assert.strictEqual(parser.execute(ok, 0, ok.length), ok.length); |
| 42 | + |
| 43 | + const tooMany = Buffer.from(`${startLine}${threeHeaders}\r\n`); |
| 44 | + assertOverflow(createParser(type, 0, 0, undefined, limit) |
| 45 | + .execute(tooMany, 0, tooMany.length)); |
| 46 | +} |
| 47 | + |
| 48 | +// The parser does not read the maxHeaderPairs property. |
| 49 | +{ |
| 50 | + const parser = createParser(REQUEST, 0, 0, undefined, 2); |
| 51 | + Object.defineProperty(parser, 'maxHeaderPairs', { |
| 52 | + get: common.mustNotCall(), |
| 53 | + }); |
| 54 | + const request = Buffer.from(`GET / HTTP/1.1\r\n${twoHeaders}\r\n`); |
| 55 | + assertOverflow(parser.execute(request, 0, request.length)); |
| 56 | +} |
| 57 | + |
| 58 | +// Main headers, trailers, and the next pipelined message are each counted |
| 59 | +// separately against the same limit. |
| 60 | +{ |
| 61 | + const parser = createParser(REQUEST, 0, 0, undefined, 4); |
| 62 | + parser[kOnHeadersComplete] = common.mustCall(undefined, 2); |
| 63 | + parser[kOnMessageComplete] = common.mustCall(undefined, 2); |
| 64 | + |
| 65 | + const pipelined = Buffer.from( |
| 66 | + 'POST /first HTTP/1.1\r\n' + |
| 67 | + 'Transfer-Encoding: chunked\r\n' + |
| 68 | + '\r\n' + |
| 69 | + '0\r\n' + |
| 70 | + twoHeaders + |
| 71 | + '\r\n' + |
| 72 | + `GET /second HTTP/1.1\r\n${twoHeaders}\r\n` |
| 73 | + ); |
| 74 | + assert.strictEqual(parser.execute(pipelined, 0, pipelined.length), pipelined.length); |
| 75 | +} |
| 76 | + |
| 77 | +// Reinitializing the parser replaces the limit. |
| 78 | +{ |
| 79 | + const parser = createParser(REQUEST, 0, 0, undefined, 2); |
| 80 | + parser.initialize(REQUEST, {}, 0, 0, undefined, 6); |
| 81 | + const request = Buffer.from(`GET / HTTP/1.1\r\n${threeHeaders}\r\n`); |
| 82 | + assert.strictEqual(parser.execute(request, 0, request.length), request.length); |
| 83 | +} |
| 84 | + |
| 85 | +// An omitted or non-positive limit means unlimited. |
| 86 | +for (const initArgs of [[], [0, 0, undefined, 0], [0, 0, undefined, -1]]) { |
| 87 | + const parser = createParser(REQUEST, ...initArgs); |
| 88 | + const request = Buffer.from(`GET / HTTP/1.1\r\n${threeHeaders}\r\n`); |
| 89 | + assert.strictEqual(parser.execute(request, 0, request.length), request.length); |
| 90 | +} |
0 commit comments