diff options
| author | Matteo Collina <hello@matteocollina.com> | 2018-08-23 16:46:07 +0200 |
|---|---|---|
| committer | Rod Vagg <rod@vagg.org> | 2018-11-28 11:36:34 +1100 |
| commit | ee618a7ab239c98d945c723a4e225bc409151736 (patch) | |
| tree | b70be2ea28bb3773d6c455a61a273cf8c5edbfb8 /lib/url.js | |
| parent | 7bfcfc2ffe4940898cf7b70890a55eb91cbdd112 (diff) | |
| download | android-node-v8-ee618a7ab239c98d945c723a4e225bc409151736.tar.gz android-node-v8-ee618a7ab239c98d945c723a4e225bc409151736.tar.bz2 android-node-v8-ee618a7ab239c98d945c723a4e225bc409151736.zip | |
http,https: protect against slow headers attack
CVE-2018-12122
An attacker can send a char/s within headers and exahust the resources
(file descriptors) of a system even with a tight max header length
protection. This PR destroys a socket if it has not received the headers
in 40s.
PR-URL: https://github.com/nodejs-private/node-private/pull/144
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Diffstat (limited to 'lib/url.js')
0 files changed, 0 insertions, 0 deletions