mirror of
https://github.com/zebrajr/node.git
synced 2025-12-07 12:20:50 +01:00
696f063c5e
CVE-2018-12122 An attacker can send a char/s within headers and exahust the resources (file descriptors) of a system even with a tight max header length protection. This PR destroys a socket if it has not received the headers in 40s. PR-URL: https://github.com/nodejs-private/node-private/pull/151 Ref: https://github.com/nodejs-private/node-private/pull/144 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com>
55 lines
1.4 KiB
JavaScript
55 lines
1.4 KiB
JavaScript
'use strict';
|
|
|
|
const common = require('../common');
|
|
if (!common.hasIPv6)
|
|
common.skip('IPv6 support required');
|
|
|
|
const initHooks = require('./init-hooks');
|
|
const verifyGraph = require('./verify-graph');
|
|
const http = require('http');
|
|
|
|
const hooks = initHooks();
|
|
hooks.enable();
|
|
|
|
const server = http.createServer(common.mustCall(function(req, res) {
|
|
res.end();
|
|
this.close(common.mustCall());
|
|
}));
|
|
server.listen(0, common.mustCall(function() {
|
|
http.get({
|
|
host: '::1',
|
|
family: 6,
|
|
port: server.address().port
|
|
}, common.mustCall());
|
|
}));
|
|
|
|
process.on('exit', function() {
|
|
hooks.disable();
|
|
|
|
verifyGraph(
|
|
hooks,
|
|
[ { type: 'TCPSERVERWRAP',
|
|
id: 'tcpserver:1',
|
|
triggerAsyncId: null },
|
|
{ type: 'TCPWRAP', id: 'tcp:1', triggerAsyncId: 'tcpserver:1' },
|
|
{ type: 'TCPCONNECTWRAP',
|
|
id: 'tcpconnect:1',
|
|
triggerAsyncId: 'tcp:1' },
|
|
{ type: 'HTTPPARSER',
|
|
id: 'httpparser:1',
|
|
triggerAsyncId: 'tcpserver:1' },
|
|
{ type: 'TCPWRAP', id: 'tcp:2', triggerAsyncId: 'tcpserver:1' },
|
|
{ type: 'Timeout', id: 'timeout:1', triggerAsyncId: 'tcp:2' },
|
|
{ type: 'TIMERWRAP', id: 'timer:1', triggerAsyncId: 'tcp:2' },
|
|
{ type: 'HTTPPARSER',
|
|
id: 'httpparser:2',
|
|
triggerAsyncId: 'tcp:2' },
|
|
{ type: 'Timeout',
|
|
id: 'timeout:2',
|
|
triggerAsyncId: 'tcp:2' },
|
|
{ type: 'SHUTDOWNWRAP',
|
|
id: 'shutdown:1',
|
|
triggerAsyncId: 'tcp:2' } ]
|
|
);
|
|
});
|