Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • N node-http-proxy
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 482
    • Issues 482
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 102
    • Merge requests 102
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Package Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • http ... PARTY!
  • node-http-proxy
  • Merge requests
  • !1276

Detect and trim any invalid incoming req header name

  • Review changes

  • Download
  • Email patches
  • Plain diff
Open Administrator requested to merge github/fork/dino-brzika/invalid_incoming_headers into master Jun 20, 2018
  • Overview 1
  • Commits 3
  • Pipelines 1
  • Changes 2

Created by: dino-brzika

Issue #1261 In web-incoming.js it is not handled if incoming req header name start or end with whitespace. Result is crashing of application. Issue is easy to reproduce by manually adding in req headers header with whitespace (example 'cookie '). In production issue is observed on node 4.8.0 and http-proxy 1.16.2 version. Application is build in Meteor which does not handle this as well. Submitted solution is to loop through req headers and when invalid header is detected, add new header with trimmed name and remove existing invalid header. In addition to this it will replace remaining whitespaces with dash(-). This is needed in order to handle case where header is named like "foo bar". Fix verified on node 4.8.0 and all tests passed.

Assignee
Assign to
Reviewers
Request review from
Time tracking
Source branch: github/fork/dino-brzika/invalid_incoming_headers