http: reject control characters in http.request()

Unsanitized paths containing line feed characters can be used for
header injection and request splitting so reject them with an exception.

There seems to be no reasonable use case for allowing control characters
(characters <= 31) while there are several scenarios where they can be
used to exploit software bugs so reject control characters altogether.

PR-URL: https://github.com/nodejs/node/pull/8923
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: not-an-aardvark <not-an-aardvark@users.noreply.github.com>

1 files changed, 12 insertions, 7 deletions

diff --git a/test/parallel/test-http-client-unescaped-path.js b/test/parallel/test-http-client-unescaped-path.js
index e01df255a8..2411d0e6be 100644
--- a/test/parallel/test-http-client-unescaped-path.js
+++ b/test/parallel/test-http-client-unescaped-path.js
@@ -1,9 +1,14 @@
 'use strict';
-var common = require('../common');
-var assert = require('assert');
-var http = require('http');
+const common = require('../common');
+const assert = require('assert');
+const http = require('http');
 
-assert.throws(function() {
-  // Path with spaces in it should throw.
-  http.get({ path: 'bad path' }, common.fail);
-}, /contains unescaped characters/);
+function* bad() {
+  for (let i = 0; i <= 32; i += 1)
+    yield 'bad' + String.fromCharCode(i) + 'path';
+}
+
+for (const path of bad()) {
+  assert.throws(() => http.get({ path }, common.fail),
+                /contains unescaped characters/);
+}