http: llhttp opt-in insecure HTTP header parsing

Allow insecure HTTP header parsing. Make clear it is insecure.

See:
- https://github.com/nodejs/node/pull/30553
- https://github.com/nodejs/node/issues/27711#issuecomment-556265881
- https://github.com/nodejs/node/issues/30515

PR-URL: https://github.com/nodejs/node/pull/30567
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

3 files changed, 11 insertions, 2 deletions

diff --git a/src/node_http_parser.cc b/src/node_http_parser.cc
index 0328dc7c0f..5e1da912e0 100644
--- a/src/node_http_parser.cc
+++ b/src/node_http_parser.cc
@@ -486,11 +486,13 @@ class Parser : public AsyncWrap, public StreamListener {
 
   static void Initialize(const FunctionCallbackInfo<Value>& args) {
     Environment* env = Environment::GetCurrent(args);
+    bool lenient = args[3]->IsTrue();
 
     uint64_t max_http_header_size = 0;
 
     CHECK(args[0]->IsInt32());
     CHECK(args[1]->IsObject());
+
     if (args.Length() > 2) {
       CHECK(args[2]->IsNumber());
       max_http_header_size = args[2].As<Number>()->Value();
@@ -515,7 +517,7 @@ class Parser : public AsyncWrap, public StreamListener {
 
     parser->set_provider_type(provider);
     parser->AsyncReset(args[1].As<Object>());
-    parser->Init(type, max_http_header_size);
+    parser->Init(type, max_http_header_size, lenient);
   }
 
   template <bool should_pause>
@@ -762,8 +764,9 @@ class Parser : public AsyncWrap, public StreamListener {
   }
 
 
-  void Init(llhttp_type_t type, uint64_t max_http_header_size) {
+  void Init(llhttp_type_t type, uint64_t max_http_header_size, bool lenient) {
     llhttp_init(&parser_, type, &settings);
+    llhttp_set_lenient(&parser_, lenient);
     header_nread_ = 0;
     url_.Reset();
     status_message_.Reset();
diff --git a/src/node_options.cc b/src/node_options.cc
index abf26fb781..831540f993 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -375,6 +375,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             &EnvironmentOptions::heap_snapshot_signal,
             kAllowedInEnvironment);
   AddOption("--http-parser", "", NoOp{}, kAllowedInEnvironment);
+  AddOption("--insecure-http-parser",
+            "use an insecure HTTP parser that accepts invalid HTTP headers",
+            &EnvironmentOptions::insecure_http_parser,
+            kAllowedInEnvironment);
   AddOption("--input-type",
             "set module type for string input",
             &EnvironmentOptions::module_type,
diff --git a/src/node_options.h b/src/node_options.h
index c4cb5dc04f..7b3ae19fe6 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -158,6 +158,8 @@ class EnvironmentOptions : public Options {
   bool print_eval = false;
   bool force_repl = false;
 
+  bool insecure_http_parser = false;
+
   bool tls_min_v1_0 = false;
   bool tls_min_v1_1 = false;
   bool tls_min_v1_2 = false;