http: stricter Transfer-Encoding and header separator parsing · nodejs/node@1da22eb · GitHub
Skip to content

Commit 1da22eb

Browse files
ShogunPandadanielleadams
authored andcommitted
http: stricter Transfer-Encoding and header separator parsing
Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Vladimir de Turckheim <vlad2t@hotmail.com> PR-URL: nodejs-private/node-private#315 CVE-ID: CVE-2022-32215,CVE-2022-32214,CVE-2022-32212 Backport-PR-URL: nodejs-private/node-private#326
1 parent c087644 commit 1da22eb

11 files changed

Lines changed: 1037 additions & 460 deletions

deps/llhttp/CMakeLists.txt

Lines changed: 89 additions & 27 deletions

deps/llhttp/README.md

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,16 @@ if (err == HPE_OK) {
9090
parser.reason);
9191
}
9292
```
93-
For more information on API usage, please refer to [src/native/api.h](https://github.com/nodejs/llhttp/blob/master/src/native/api.h).
93+
For more information on API usage, please refer to [src/native/api.h](https://github.com/nodejs/llhttp/blob/main/src/native/api.h).
94+
95+
## Build Instructions
96+
97+
Make sure you have [Node.js](https://nodejs.org/), npm and npx installed. Then under project directory run:
98+
99+
```sh
100+
npm install
101+
make
102+
```
94103

95104
---
96105

@@ -99,20 +108,41 @@ For more information on API usage, please refer to [src/native/api.h](https://gi
99108
* Python: [pallas/pyllhttp][8]
100109
* Ruby: [metabahn/llhttp][9]
101110

102-
103111
### Using with CMake
104112

105113
If you want to use this library in a CMake project you can use the snippet below.
106114

107115
```
108116
FetchContent_Declare(llhttp
109-
URL "https://github.com/nodejs/llhttp/releases/download/v6.0.4/llhttp-release-v6.0.4.tar.gz") # Using version 6.0.4
117+
URL "https://github.com/nodejs/llhttp/releases/download/v6.0.5/llhttp-release-v6.0.5.tar.gz") # Using version 6.0.5
110118
111119
FetchContent_MakeAvailable(llhttp)
112120
113121
target_link_libraries(${EXAMPLE_PROJECT_NAME} ${PROJECT_LIBRARIES} llhttp ${PROJECT_NAME})
114122
```
115123

124+
## Building on Windows
125+
126+
### Installation
127+
128+
* `choco install git`
129+
* `choco install node`
130+
* `choco install llvm` (or install the `C++ Clang tools for Windows` optional package from the Visual Studio 2019 installer)
131+
* `choco install make` (or if you have MinGW, it comes bundled)
132+
133+
1. Ensure that `Clang` and `make` are in your system path.
134+
2. Using Git Bash, clone the repo to your preferred location.
135+
3. Cd into the cloned directory and run `npm install`
136+
5. Run `make`
137+
6. Your `repo/build` directory should now have `libllhttp.a` and `libllhttp.so` static and dynamic libraries.
138+
7. When building your executable, you can link to these libraries. Make sure to set the build folder as an include path when building so you can reference the declarations in `repo/build/llhttp.h`.
139+
140+
### A simple example on linking with the library:
141+
142+
Assuming you have an executable `main.cpp` in your current working directory, you would run: `clang++ -Os -g3 -Wall -Wextra -Wno-unused-parameter -I/path/to/llhttp/build main.cpp /path/to/llhttp/build/libllhttp.a -o main.exe`.
143+
144+
If you are getting `unresolved external symbol` linker errors you are likely attempting to build `llhttp.c` without linking it with object files from `api.c` and `http.c`.
145+
116146
#### LICENSE
117147

118148
This software is licensed under the MIT License.

deps/llhttp/include/llhttp.h

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
#define LLHTTP_VERSION_MAJOR 6
55
#define LLHTTP_VERSION_MINOR 0
6-
#define LLHTTP_VERSION_PATCH 4
6+
#define LLHTTP_VERSION_PATCH 7
77

88
#ifndef LLHTTP_STRICT_MODE
99
# define LLHTTP_STRICT_MODE 0
@@ -59,6 +59,7 @@ enum llhttp_errno {
5959
HPE_OK = 0,
6060
HPE_INTERNAL = 1,
6161
HPE_STRICT = 2,
62+
HPE_CR_EXPECTED = 25,
6263
HPE_LF_EXPECTED = 3,
6364
HPE_UNEXPECTED_CONTENT_LENGTH = 4,
6465
HPE_CLOSED_CONNECTION = 5,
@@ -100,7 +101,8 @@ typedef enum llhttp_flags llhttp_flags_t;
100101
enum llhttp_lenient_flags {
101102
LENIENT_HEADERS = 0x1,
102103
LENIENT_CHUNKED_LENGTH = 0x2,
103-
LENIENT_KEEP_ALIVE = 0x4
104+
LENIENT_KEEP_ALIVE = 0x4,
105+
LENIENT_TRANSFER_ENCODING = 0x8
104106
};
105107
typedef enum llhttp_lenient_flags llhttp_lenient_flags_t;
106108

@@ -172,6 +174,7 @@ typedef enum llhttp_method llhttp_method_t;
172174
XX(0, OK, OK) \
173175
XX(1, INTERNAL, INTERNAL) \
174176
XX(2, STRICT, STRICT) \
177+
XX(25, CR_EXPECTED, CR_EXPECTED) \
175178
XX(3, LF_EXPECTED, LF_EXPECTED) \
176179
XX(4, UNEXPECTED_CONTENT_LENGTH, UNEXPECTED_CONTENT_LENGTH) \
177180
XX(5, CLOSED_CONNECTION, CLOSED_CONNECTION) \
@@ -374,8 +377,6 @@ LLHTTP_EXPORT
374377
void llhttp_init(llhttp_t* parser, llhttp_type_t type,
375378
const llhttp_settings_t* settings);
376379

377-
#if defined(__wasm__)
378-
379380
LLHTTP_EXPORT
380381
llhttp_t* llhttp_alloc(llhttp_type_t type);
381382

@@ -400,8 +401,6 @@ int llhttp_get_status_code(llhttp_t* parser);
400401
LLHTTP_EXPORT
401402
uint8_t llhttp_get_upgrade(llhttp_t* parser);
402403

403-
#endif // defined(__wasm__)
404-
405404
/* Reset an already initialized parser back to the start state, preserving the
406405
* existing parser type, callback settings, user data, and lenient flags.
407406
*/
@@ -556,6 +555,19 @@ void llhttp_set_lenient_chunked_length(llhttp_t* parser, int enabled);
556555
*/
557556
void llhttp_set_lenient_keep_alive(llhttp_t* parser, int enabled);
558557

558+
/* Enables/disables lenient handling of `Transfer-Encoding` header.
559+
*
560+
* Normally `llhttp` would error when a `Transfer-Encoding` has `chunked` value
561+
* and another value after it (either in a single header or in multiple
562+
* headers whose value are internally joined using `, `).
563+
* This is mandated by the spec to reliably determine request body size and thus
564+
* avoid request smuggling.
565+
* With this flag the extra value will be parsed normally.
566+
*
567+
* **(USE AT YOUR OWN RISK)**
568+
*/
569+
void llhttp_set_lenient_transfer_encoding(llhttp_t* parser, int enabled);
570+
559571
#ifdef __cplusplus
560572
} /* extern "C" */
561573
#endif

deps/llhttp/libllhttp.pc.in

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
prefix=@CMAKE_INSTALL_PREFIX@
2+
exec_prefix=@CMAKE_INSTALL_PREFIX@
3+
libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@
4+
includedir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_INCLUDEDIR@
5+
6+
Name: libllhttp
7+
Description: Node.js llhttp Library
8+
Version: @PROJECT_VERSION@
9+
Libs: -L${libdir} -lllhttp
10+
Cflags: -I${includedir}

deps/llhttp/src/api.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,14 @@ void llhttp_set_lenient_keep_alive(llhttp_t* parser, int enabled) {
253253
}
254254
}
255255

256+
void llhttp_set_lenient_transfer_encoding(llhttp_t* parser, int enabled) {
257+
if (enabled) {
258+
parser->lenient_flags |= LENIENT_TRANSFER_ENCODING;
259+
} else {
260+
parser->lenient_flags &= ~LENIENT_TRANSFER_ENCODING;
261+
}
262+
}
263+
256264
/* Callbacks */
257265

258266

deps/llhttp/src/http.c

Lines changed: 2 additions & 1 deletion

0 commit comments

Comments
 (0)