unofficial mirror of guix-patches@gnu.org 
 help / color / mirror / code / Atom feed
blob 215c920e53a77a3cfd4320eb478df6d1fda06ff0 3926 bytes (raw)
name: gnu/packages/patches/llhttp-bootstrap-CVE-2020-8287.patch 	 # note: path name is non-authoritative(*)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
 
This patch comes from upstream.  It corresponds to a patch applied to
the generated C source code for llhttp included in Node.js 14.16.0
(see commit 641f786bb1a1f6eb1ff8750782ed939780f2b31a).  That commit
fixes CVE-2020-8287.  With this patch, the output of our
llhttp-bootstrap package matches the files included in Node.js 14.16.0
exactly.

commit e9b36ea64709c35ca66094d5cf3787f444029601
Author: Fedor Indutny <fedor@indutny.com>
Date:   Sat Oct 10 19:56:01 2020 -0700

    http: unset `F_CHUNKED` on new `Transfer-Encoding`
    
    Duplicate `Transfer-Encoding` header should be a treated as a single,
    but with original header values concatenated with a comma separator. In
    the light of this, even if the past `Transfer-Encoding` ended with
    `chunked`, we should be not let the `F_CHUNKED` to leak into the next
    header, because mere presence of another header indicates that `chunked`
    is not the last transfer-encoding token.

diff --git a/src/llhttp/http.ts b/src/llhttp/http.ts
index f4f1a6e..0a0c365 100644
--- a/src/llhttp/http.ts
+++ b/src/llhttp/http.ts
@@ -460,11 +460,19 @@ export class HTTP {
       .match([ ' ', '\t' ], n('header_value_discard_ws'))
       .otherwise(checkContentLengthEmptiness);
 
+    // Multiple `Transfer-Encoding` headers should be treated as one, but with
+    // values separate by a comma.
+    //
+    // See: https://tools.ietf.org/html/rfc7230#section-3.2.2
+    const toTransferEncoding = this.unsetFlag(
+      FLAGS.CHUNKED,
+      'header_value_te_chunked');
+
     n('header_value_start')
       .otherwise(this.load('header_state', {
         [HEADER_STATE.UPGRADE]: this.setFlag(FLAGS.UPGRADE, fallback),
         [HEADER_STATE.TRANSFER_ENCODING]: this.setFlag(
-          FLAGS.TRANSFER_ENCODING, 'header_value_te_chunked'),
+          FLAGS.TRANSFER_ENCODING, toTransferEncoding),
         [HEADER_STATE.CONTENT_LENGTH]: n('header_value_content_length_once'),
         [HEADER_STATE.CONNECTION]: n('header_value_connection'),
       }, 'header_value'));
@@ -847,6 +855,11 @@ export class HTTP {
     return span.start(span.end(this.node(next)));
   }
 
+  private unsetFlag(flag: FLAGS, next: string | Node): Node {
+    const p = this.llparse;
+    return p.invoke(p.code.and('flags', ~flag), this.node(next));
+  }
+
   private setFlag(flag: FLAGS, next: string | Node): Node {
     const p = this.llparse;
     return p.invoke(p.code.or('flags', flag), this.node(next));
diff --git a/test/request/transfer-encoding.md b/test/request/transfer-encoding.md
index a7d1681..b0891d6 100644
--- a/test/request/transfer-encoding.md
+++ b/test/request/transfer-encoding.md
@@ -353,6 +353,38 @@ off=106 headers complete method=3 v=1/1 flags=200 content_length=0
 off=106 error code=15 reason="Request has invalid `Transfer-Encoding`"
 ```
 
+## POST with `chunked` and duplicate transfer-encoding
+
+<!-- meta={"type": "request", "noScan": true} -->
+```http
+POST /post_identity_body_world?q=search#hey HTTP/1.1
+Accept: */*
+Transfer-Encoding: chunked
+Transfer-Encoding: deflate
+
+World
+```
+
+```log
+off=0 message begin
+off=5 len=38 span[url]="/post_identity_body_world?q=search#hey"
+off=44 url complete
+off=54 len=6 span[header_field]="Accept"
+off=61 header_field complete
+off=62 len=3 span[header_value]="*/*"
+off=67 header_value complete
+off=67 len=17 span[header_field]="Transfer-Encoding"
+off=85 header_field complete
+off=86 len=7 span[header_value]="chunked"
+off=95 header_value complete
+off=95 len=17 span[header_field]="Transfer-Encoding"
+off=113 header_field complete
+off=114 len=7 span[header_value]="deflate"
+off=123 header_value complete
+off=125 headers complete method=3 v=1/1 flags=200 content_length=0
+off=125 error code=15 reason="Request has invalid `Transfer-Encoding`"
+```
+
 ## POST with `chunked` before other transfer-coding (lenient)
 
 TODO(indutny): should we allow it even in lenient mode? (Consider disabling

debug log:

solving 215c920e53 ...
found 215c920e53 in https://git.savannah.gnu.org/cgit/guix.git

(*) Git path names are given by the tree(s) the blob belongs to.
    Blobs themselves have no identifier aside from the hash of its contents.^

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).