http: verify method is a string #10111

lucamaraschi · 2016-12-04T08:51:19Z

Checklist

tests and/or benchmarks are included
commit message follows commit guidelines

Affected core subsystem(s)

http

Description of change

Added strict check for http request method to be a string. If method is not a string (or undefined or null) a TypeError exceptions is thrown.
The method value is still defaulted to GET in the following cases:

method is undefined
method is null
This fixes the http-client to crash if options.method in http.request was set to a number not equal to 0.

mscdex · 2016-12-04T09:00:42Z

lib/_http_client.js

+  if (_method !== undefined && _method !== null
+    && typeof _method !== 'string') {
+    throw new TypeError('Method must be a string');
+  }


For the best backwards compatibility (and to emulate the method value selection behavior below the typeof check), I think the undefined/null check should be removed and just test for truthiness:

if (options.method && typeof options.method !== 'string') { throw new TypeError('Method must be a string'); }

The reason being that options.method could be one of several non-truthy values, such as 0 and false.

In this case if options.method is set to 0 results in a falsy value which is going to default the method to GET in the following check.

@mscdex that would not fix the non-truthy values, confusing the defaulting of 0 values to GET.

Well, it's a difference between semver-ness. This change is definitely going to be semver-major as-is, but it could be semver-patch with the check I suggested. It's up to you.

cjihrig · 2016-12-04T13:26:01Z

test/parallel/test-http-client-check-http-token.js

+const assert = require('assert');
+const http = require('http');
+
+const expectedSuccesses = {


Only the keys seem to be used. This could probably be an array...

cjihrig · 2016-12-04T13:26:43Z

test/parallel/test-http-client-check-http-token.js

+    http.request({ method: method, port: server.address().port }).end();
+  }
+
+  ok(undefined);


... and then you can loop over the array here. Right now, the number of times ok() is called is independent of methods.

cjihrig · 2016-12-04T13:30:02Z

test/parallel/test-http-client-check-http-token.js

+  function fail(input) {
+    assert.throws(() => {
+      http.request({ method: input, path: '/' }, common.fail);
+    }, /Method must be a string/);


If you want to be really strict, this could be /^TypeError: Method must be a string$/.

cjihrig · 2016-12-04T13:32:04Z

lib/_http_client.js

@@ -68,6 +68,11 @@ function ClientRequest(options, cb) {
  self.socketPath = options.socketPath;
  self.timeout = options.timeout;

+  const _method = options.method;
+  if (_method !== undefined && _method !== null


This can be written as:

if (_method != null && typeof _method !== 'string')

If you don't choose to rewrite like that, the && should be moved to the previous line, and the second line should be lined up. I'm surprised the linter doesn't complain.

lucamaraschi · 2016-12-06T07:30:27Z

@cjihrig and @mscdex I amended the PR adding your feedbacks.

cjihrig · 2016-12-06T14:30:54Z

CI: https://ci.nodejs.org/job/node-test-pull-request/5251/

UPDATE: Another try - https://ci.nodejs.org/job/node-test-pull-request/5252/

cjihrig · 2016-12-06T15:50:35Z

lib/_http_client.js

+  const _method = options.method;
+  if (_method != null && typeof _method !== 'string') {
+    throw new TypeError('Method must be a string');
+  }
  var method = self.method = (options.method || 'GET').toUpperCase();


We should probably use options.method or _method consistently. Right now it's a mix.

The common._checkIsHttpToken() check on line 77 already includes a test to ensure method is a string.

cjihrig · 2016-12-06T15:50:49Z

One CI failure looks unrelated.

sam-github · 2016-12-06T15:54:09Z

Is this really semver-major? Wouldn't node have thrown an unexpected internal type error when it tried to use the method as a String, even though it wasn't? I understand when text of warning messages are changed it can break user-space, but user-space depending on something like undefined is not a function instead of a proper type error seems a bit more far fetched. Generally, people test for operation errors, not syntax errors.

Just asking for clarification here.

targos · 2016-12-06T16:03:45Z

@sam-github See mscdex's comment here: #10111 (comment)
It's semver-major because before the change, if options.method was any falsy value, it would default to 'GET'. Now it throws (unless it's the empty string).
IMO the check should be changed so that we can remove the semver-major label.

cjihrig · 2016-12-06T16:05:24Z

I think this is the correct thing to do moving forward. A second PR that is more backwards compatible might be good for Node 7 and earlier.

jasnell · 2016-12-06T20:27:13Z

While I appreciate the new test, the common._checkIsHttpToken() check that is already there already validates that method is a string and already throws a TypeError if it is not.

mscdex · 2016-12-06T20:36:27Z

@jasnell The issue though is that that common._checkIsHttpToken() check is happening after options.method || 'GET'. So if someone passes say false for options.method, it will be implicitly changed to 'GET'. This PR is just being more strict, presumably to catch programmer errors.

cjihrig · 2016-12-06T21:59:37Z

In addition to what @mscdex said, if the method is not a string and is truthy, then an exception is thrown: TypeError: (options.method || "GET").toUpperCase is not a function

jasnell · 2016-12-06T22:04:53Z

ok.. works for me :-)

mscdex · 2016-12-07T07:25:24Z

lib/_http_client.js

@@ -68,7 +68,11 @@ function ClientRequest(options, cb) {
  self.socketPath = options.socketPath;
  self.timeout = options.timeout;

-  var method = self.method = (options.method || 'GET').toUpperCase();
+  const _method = options.method;


Maybe we can just move the var method declaration up here and re-assign on line 75, that way we don't have a second variable for the same thing?

cjihrig · 2016-12-07T15:56:16Z

lib/_http_client.js

@@ -68,7 +68,11 @@ function ClientRequest(options, cb) {
  self.socketPath = options.socketPath;
  self.timeout = options.timeout;

-  var method = self.method = (options.method || 'GET').toUpperCase();
+  let method = options.method;


Can you keep var. We haven't really made the switch to let in lib/ code for performance reasons.

cjihrig

LGTM. Another CI: https://ci.nodejs.org/job/node-test-pull-request/5289/

cjihrig · 2016-12-08T15:01:16Z

Landed in df39784. Thanks!

Prior to this commit, it was possible to pass a truthy non-string value as the HTTP method to the HTTP client, resulting in an exception being thrown. This commit adds validation to the method. PR-URL: #10111 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: James M Snell <[email protected]>

Prior to this commit, it was possible to pass a truthy non-string value as the HTTP method to the HTTP client, resulting in an exception being thrown. This commit adds validation to the method. PR-URL: nodejs#10111 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: James M Snell <[email protected]>

http: verify method is a string

242c5c9

nodejs-github-bot added the http Issues or PRs related to the http subsystem. label Dec 4, 2016

mscdex reviewed Dec 4, 2016

View reviewed changes

mscdex added the semver-major PRs that contain breaking changes and should be released in the next major version. label Dec 4, 2016

cjihrig requested changes Dec 4, 2016

View reviewed changes

http: added @cjihrig feedbacks

c711ac7

cjihrig reviewed Dec 6, 2016

View reviewed changes

http: renamed method for consistency

29f78c1

mscdex reviewed Dec 7, 2016

View reviewed changes

http: variables rearrangement

7774c3a

cjihrig reviewed Dec 7, 2016

View reviewed changes

http: changed let to var

9561854

cjihrig approved these changes Dec 7, 2016

View reviewed changes

jasnell approved these changes Dec 7, 2016

View reviewed changes

cjihrig closed this Dec 8, 2016

jasnell mentioned this pull request Apr 4, 2017

8.0.0 Release Proposal #12220

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

http: verify method is a string #10111

http: verify method is a string #10111

lucamaraschi commented Dec 4, 2016 •

edited

Loading

mscdex Dec 4, 2016 •

edited

Loading

lucamaraschi Dec 4, 2016 •

edited

Loading

lucamaraschi Dec 4, 2016

mscdex Dec 4, 2016

cjihrig Dec 4, 2016

cjihrig Dec 4, 2016

cjihrig Dec 4, 2016

cjihrig Dec 4, 2016

lucamaraschi commented Dec 6, 2016

cjihrig commented Dec 6, 2016 •

edited

Loading

cjihrig Dec 6, 2016

jasnell Dec 6, 2016

cjihrig commented Dec 6, 2016 •

edited

Loading

sam-github commented Dec 6, 2016

targos commented Dec 6, 2016

cjihrig commented Dec 6, 2016

jasnell commented Dec 6, 2016

mscdex commented Dec 6, 2016 •

edited

Loading

cjihrig commented Dec 6, 2016

jasnell commented Dec 6, 2016

mscdex Dec 7, 2016

cjihrig Dec 7, 2016

cjihrig left a comment

cjihrig commented Dec 8, 2016

http: verify method is a string #10111

http: verify method is a string #10111

Conversation

lucamaraschi commented Dec 4, 2016 • edited Loading

Checklist

Affected core subsystem(s)

Description of change

mscdex Dec 4, 2016 • edited Loading

Choose a reason for hiding this comment

lucamaraschi Dec 4, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lucamaraschi commented Dec 6, 2016

cjihrig commented Dec 6, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cjihrig commented Dec 6, 2016 • edited Loading

sam-github commented Dec 6, 2016

targos commented Dec 6, 2016

cjihrig commented Dec 6, 2016

jasnell commented Dec 6, 2016

mscdex commented Dec 6, 2016 • edited Loading

cjihrig commented Dec 6, 2016

jasnell commented Dec 6, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cjihrig left a comment

Choose a reason for hiding this comment

cjihrig commented Dec 8, 2016

lucamaraschi commented Dec 4, 2016 •

edited

Loading

mscdex Dec 4, 2016 •

edited

Loading

lucamaraschi Dec 4, 2016 •

edited

Loading

cjihrig commented Dec 6, 2016 •

edited

Loading

cjihrig commented Dec 6, 2016 •

edited

Loading

mscdex commented Dec 6, 2016 •

edited

Loading