Skip to content

test,http: check that http server is robust from handler abuse

Rodrigo Muino Tomonari requested to merge github/fork/Trott/robust-from-tampering into master

The only way I could find to complete coverage for _http_common.js is to use semi-private (exposed but probably shouldn't be) handlers to get the state into something weird. With the if-condition being checked (see Refs) commented out, I get this result from this test:

node:_http_common:140
  if (len > 0 && !stream._dumped) {
                         ^

TypeError: Cannot read property '_dumped' of null
    at HTTPParser.parserOnBody (node:_http_common:140:26)

With the check in place, the test passes without an error. Seems like quite the edge case, but I'm going to assume it's there for a reason.

Refs: https://coverage.nodejs.org/coverage-b560645d6b0a4bed/lib/_http_common.js.html#L137

Merge request reports