http: throw if 'host' agent header is not a string value

gntem · Trott · commit 2daf883a1895 · 2019-09-18T06:08:52.000-07:00
If the 'host' agent header is an array or other non-string value, throw. PR-URL: #29568 Fixes: #29408 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
diff --git a/lib/_http_agent.js b/lib/_http_agent.js
@@ -27,7 +27,11 @@ const net = require('net');
 const EventEmitter = require('events');
 const debug = require('internal/util/debuglog').debuglog('http');
 const { async_id_symbol } = require('internal/async_hooks').symbols;
-
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+  },
+} = require('internal/errors');
 // New Agent code.
 
 // The largest departure from the previous implementation is that
@@ -240,6 +244,11 @@ function calculateServerName(options, req) {
   let servername = options.host;
   const hostHeader = req.getHeader('host');
   if (hostHeader) {
+    if (typeof hostHeader !== 'string') {
+      throw new ERR_INVALID_ARG_TYPE('options.headers.host',
+                                     'String', hostHeader);
+    }
+
     // abc => abc
     // abc:123 => abc
     // [::1] => ::1
diff --git a/test/parallel/test-http-client-headers-host-array.js b/test/parallel/test-http-client-headers-host-array.js
@@ -0,0 +1,23 @@
+'use strict';
+
+require('../common');
+
+const assert = require('assert');
+const http = require('http');
+
+{
+
+  const options = {
+    port: '80',
+    path: '/',
+    headers: {
+      host: []
+    }
+  };
+
+  assert.throws(() => {
+    http.request(options);
+  }, {
+    code: /ERR_INVALID_ARG_TYPE/
+  }, 'http request should throw when passing array as header host');
+}
