0
0
mirror of https://github.com/nodejs/node.git synced 2024-12-01 16:10:02 +01:00
nodejs/lib
Evan Lucas ca5f8f80e3 http: check reason chars in writeHead
Previously, the reason argument passed to ServerResponse#writeHead was
not being properly validated.  One could pass CRLFs which could lead to
http response splitting. This commit changes the behavior to throw an
error in the event any invalid characters are included in the reason.

CVE-2016-5325

PR-URL: https://github.com/nodejs/node-private/pull/60
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
2016-09-28 11:19:18 +10:00
..
internal fs: move stringToFlags() to lib/internal 2016-09-23 18:24:53 +02:00
_debug_agent.js debugger: use arrow function for lexical this 2016-08-18 16:44:38 -07:00
_debugger.js debugger: remove obsolete setTimeout 2016-06-07 13:32:05 -07:00
_http_agent.js https: fix memory leak with https.request() 2016-09-21 03:22:15 +03:00
_http_client.js http: socket connection timeout for http request 2016-09-26 13:33:52 +03:00
_http_common.js http: fix connection upgrade checks 2016-08-26 10:17:34 -04:00
_http_incoming.js http: fix no dumping after maybeReadMore 2016-06-15 12:50:19 -04:00
_http_outgoing.js http: fix connection upgrade checks 2016-08-26 10:17:34 -04:00
_http_server.js http: check reason chars in writeHead 2016-09-28 11:19:18 +10:00
_linklist.js lib: use emitWarning instead of printDeprecationMessage 2016-09-02 13:15:22 -07:00
_stream_duplex.js
_stream_passthrough.js
_stream_readable.js stream: avoid caching prepend check 2016-08-17 18:47:41 -07:00
_stream_transform.js stream: 'data' argument on callback of Transform._flush() 2016-06-09 11:06:01 +02:00
_stream_wrap.js
_stream_writable.js stream: improve unimplemented _write() error 2016-07-21 11:24:26 -04:00
_tls_common.js tls: improve createSecureContext in _tls_common 2016-09-28 09:15:27 +08:00
_tls_legacy.js lib: replace legacy uses of __defineGetter__ 2016-05-16 17:01:34 -07:00
_tls_wrap.js tools: add additional ESLint rules 2016-09-20 23:21:10 -04:00
.eslintrc
assert.js tools: replace custom ESLint rule with built-in 2016-09-12 21:12:03 -07:00
buffer.js buffer: fix performance regression 2016-09-26 20:14:32 +02:00
child_process.js child_process, win: fix shell spawn with AutoRun 2016-09-09 20:51:43 +02:00
cluster.js cluster: support stdio option for workers 2016-08-01 15:08:42 -04:00
console.js
constants.js src: refactor require('constants') 2016-05-17 11:05:18 -07:00
crypto.js crypto: add crypto.timingSafeEqual() 2016-09-07 16:29:41 -07:00
dgram.js dgram: prefer strict equality, type validation 2016-09-08 22:21:31 +01:00
dns.js dns: tweak regex for IPv6 addresses 2016-09-23 01:03:09 +03:00
domain.js domain: add message for dispose deprecation 2016-06-07 00:27:42 -04:00
events.js events: make memory leak warning name more verbose 2016-09-04 17:11:59 +02:00
fs.js fs: do not emit 'stop' watch event synchronously 2016-09-24 01:24:04 +03:00
http.js http: remove deprecated Client interface 2016-08-29 21:44:58 -04:00
https.js
module.js lib: use emitWarning instead of printDeprecationMessage 2016-09-02 13:15:22 -07:00
net.js http: socket connection timeout for http request 2016-09-26 13:33:52 +03:00
os.js os: deprecate tmpDir() in favour of tmpdir() 2016-06-30 14:52:13 +02:00
path.js path: fallback to process cwd when resolving drive cwd 2016-09-24 01:14:56 +03:00
process.js
punycode.js punycode: update to v2.0.0 2016-06-17 17:03:49 +02:00
querystring.js benchmark,test,lib: remove extra spaces 2016-05-11 23:18:16 -07:00
readline.js readline: key interval delay for \r & \n 2016-09-08 20:16:39 +05:30
repl.js test,lib: align arguments in multiline calls 2016-09-20 10:22:23 -07:00
stream.js
string_decoder.js string_decoder: fix bad utf8 character handling 2016-06-23 23:18:10 -04:00
sys.js lib: use emitWarning instead of printDeprecationMessage 2016-09-02 13:15:22 -07:00
timers.js timers: remove unreachable code 2016-09-15 14:26:42 +08:00
tls.js tls: add 'new' keyword for Array constructor call 2016-09-18 14:25:57 +02:00
tty.js tty: set the handle to blocking mode 2016-08-10 23:41:28 +02:00
url.js url: fix off-by-one error in loop handling dots 2016-09-11 21:16:17 -07:00
util.js util: Add format for SharedArrayBuffer 2016-09-26 08:07:04 -07:00
v8.js
vm.js vm: change ContextifyScript to Script in comment 2016-09-08 08:41:23 +02:00
zlib.js zlib: move constants into zlib.constants 2016-06-11 17:24:35 -07:00