mirror of
https://github.com/nodejs/node.git
synced 2026-10-28 10:15:07 +08:00
Matteo Collina
21436f0405
Makes IncomingMessage.prototype.headers and trailers have a null prototype, matching the existing behavior of headersDistinct and trailersDistinct. Fixes prototype pollution concerns where headers like __proto__ could be interpreted as prototype manipulation. Refs: https://github.com/nodejs/node/issues/61771 PR-URL: https://github.com/nodejs/node/pull/62900 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day> Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com> Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
67 lines
2.5 KiB
JavaScript
67 lines
2.5 KiB
JavaScript
// Copyright Joyent, Inc. and other Node contributors.
|
|
//
|
|
// Permission is hereby granted, free of charge, to any person obtaining a
|
|
// copy of this software and associated documentation files (the
|
|
// "Software"), to deal in the Software without restriction, including
|
|
// without limitation the rights to use, copy, modify, merge, publish,
|
|
// distribute, sublicense, and/or sell copies of the Software, and to permit
|
|
// persons to whom the Software is furnished to do so, subject to the
|
|
// following conditions:
|
|
//
|
|
// The above copyright notice and this permission notice shall be included
|
|
// in all copies or substantial portions of the Software.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
|
|
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
|
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
|
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
|
// USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
|
|
'use strict';
|
|
const common = require('../common');
|
|
const assert = require('assert');
|
|
|
|
const http = require('http');
|
|
|
|
const server = http.createServer(common.mustCall(function(request, response) {
|
|
const socket = response.socket;
|
|
|
|
// Removed headers should stay removed, even if node automatically adds them
|
|
// to the output:
|
|
response.removeHeader('connection');
|
|
response.removeHeader('transfer-encoding');
|
|
response.removeHeader('content-length');
|
|
|
|
// Make sure that removing and then setting still works:
|
|
response.removeHeader('date');
|
|
response.setHeader('date', 'coffee o clock');
|
|
|
|
response.on('finish', common.mustCall(function() {
|
|
// The socket should be closed immediately, with no keep-alive, because
|
|
// no content-length or transfer-encoding are used.
|
|
assert.strictEqual(socket.writableEnded, true);
|
|
}));
|
|
|
|
response.end('beep boop\n');
|
|
}));
|
|
|
|
server.listen(0, common.mustCall(function() {
|
|
http.get({ port: this.address().port }, common.mustCall((res) => {
|
|
assert.strictEqual(res.statusCode, 200);
|
|
assert.deepStrictEqual(res.headers, { __proto__: null, date: 'coffee o clock' });
|
|
|
|
let response = '';
|
|
res.setEncoding('ascii');
|
|
res.on('data', function(chunk) {
|
|
response += chunk;
|
|
});
|
|
|
|
res.on('end', common.mustCall(() => {
|
|
assert.strictEqual(response, 'beep boop\n');
|
|
server.close();
|
|
}));
|
|
}));
|
|
}));
|