Repository navigation
HTTP response corrupted with status 400 when URL includes pipe character (|) #27584
Description
- Version: v12.1.0 v12.0.0
- Platform: MacOS 10.14.2 - Darwin Kernel Version 18.5.0: Mon Mar 11 20:40:32 PDT 2019; root:xnu-4903.251.3~3/RELEASE_X86_64 x8
6_64
My code:
index.js
var http = require('http');
var url = require('url');
http.createServer(function (req, res) {
res.writeHead(200, { 'Content-Type': 'text/html' });
var q = url.parse(req.url, true).query;
var search = q.search;
res.end(search);
}).listen(8080);
Starting command: node index.js
Chrome: Version 74.0.3729.131 (Official Build) (64-bit)
When I try to request to my http service, it is working fine with normal url like
http://localhost:8080/?search=example
But, when the url come to http://localhost:8080/?search=example| or http://localhost:8080/?sea|rch=example . My browser gets back This page isn’t working and HTTP ERROR 400 (the request did not appeared on Network tab of Chrome devtool) .
Try again with curl or Postman, these urls are working fine 🤔
=> When I use older node version like v11.11.0 I don't get any errors.
Activity
addaleax commentedon May 6, 2019
Thank you for reporting this bug! It’s an issue that seems to occur because we switched out the HTTP parser library default in Node 12. The good news is that you can use
--http-parser=legacyto work around this issue for now, and get consistent behaviour on both v11.x and v12.x.addaleax commentedon May 6, 2019
Yes, this seems like something that should be fixed in llhttp to me. At least browsers and curl do not percent-encode
|in the given example URLs./cc @indutny @nodejs/http
indutny commentedon May 6, 2019
/me is on it
indutny commentedon May 6, 2019
🤦 I literally missed this single character. Thank you @hoangsetup for catching this!
constants: add `|` to list of allowed URL chars
indutny commentedon May 6, 2019
See: nodejs/llhttp#24
constants: add `|` to list of allowed URL chars
deps: update llhttp to 1.1.3
constants: add `|` to list of allowed URL chars
deps: update llhttp to 1.1.3