Matteo Collina 696f063c5e http,https: protect against slow headers attack ...

CVE-2018-12122

An attacker can send a char/s within headers and exahust the resources
(file descriptors) of a system even with a tight max header length
protection. This PR destroys a socket if it has not received the headers
in 40s.

PR-URL: https://github.com/nodejs-private/node-private/pull/151
Ref: https://github.com/nodejs-private/node-private/pull/144
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>

2018-11-27 15:07:09 +11:00

..

coverage.md

…

hook-checks.js

test: fix spelling in test case comments

2018-03-29 23:28:21 -04:00

init-hooks.js

async_hooks: replace concat w template literals

2017-10-17 23:27:06 -07:00

test-callback-error.js

src,doc,test: Fix common misspellings

2018-05-02 14:30:43 -04:00

test-connection.ssl.js

test: simplify test skipping

2017-07-19 15:02:06 -04:00

test-crypto-pbkdf2.js

test: simplify test skipping

2017-07-19 15:02:06 -04:00

test-crypto-randomBytes.js

test: simplify test skipping

2017-07-19 15:02:06 -04:00

test-disable-in-init.js

test: remove unused function args

2017-09-12 03:17:15 +02:00

test-embedder.api.async-resource-no-type.js

async_hooks,doc: some async_hooks improvements

2017-09-20 09:23:00 -07:00

test-embedder.api.async-resource.after-on-destroyed.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-embedder.api.async-resource.before-on-destroyed.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-embedder.api.async-resource.improper-order.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-embedder.api.async-resource.improper-unwind.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-embedder.api.async-resource.js

async_hooks: add destroy event for gced AsyncResources

2018-01-19 13:13:49 -05:00

test-embedder.api.async-resource.runInAsyncScope.js

async_hooks: deprecate unsafe emit{Before,After}

2018-08-16 11:38:50 +10:00

test-emit-before-after.js

async_hooks: deprecate undocumented API

2018-01-19 13:14:00 -05:00

test-emit-init.js

async_hooks: deprecate undocumented API

2018-01-19 13:14:00 -05:00

test-enable-disable.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-enable-in-init.js

async_hooks: fix nested hooks mutation

2017-07-19 15:02:33 -04:00

test-force-checks-flag.js

async_hooks: skip runtime checks when disabled

2017-10-23 17:18:17 -04:00

test-fseventwrap.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-fsreqwrap-access.js

test: improve async hooks test error messages

2017-06-05 12:27:26 -07:00

test-fsreqwrap-readFile.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-getaddrinforeqwrap.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-getnameinforeqwrap.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-graph.connection.js

test: simplify test skipping

2017-07-19 15:02:06 -04:00

test-graph.fsreq-readFile.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-graph.http.js

http,https: protect against slow headers attack

2018-11-27 15:07:09 +11:00

test-graph.intervals.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-graph.pipe.js

test: remove unused param in test-graph.pipe

2017-09-12 03:18:17 +02:00

test-graph.pipeconnect.js

test: move tmpdir to submodule of common

2018-03-29 23:28:22 -04:00

test-graph.shutdown.js

async_wrap: add provider types for net server

2018-01-19 13:14:10 -05:00

test-graph.signal.js

test: fix flaky async-hooks/test-graph.signal

2017-12-20 01:59:32 +00:00

test-graph.statwatcher.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-graph.tcp.js

test: remove common.PORT from parallel tests

2018-04-12 01:11:36 +01:00

test-graph.timeouts.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-graph.tls-write.js

test: remove common.PORT from parallel tests

2018-04-12 01:11:36 +01:00

test-httpparser.request.js

test: refactor async-hooks/test-httparser tests

2017-09-12 03:16:55 +02:00

test-httpparser.response.js

test: refactor async-hooks/test-httparser tests

2017-09-12 03:16:55 +02:00

test-immediate.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-internal-nexttick-default-trigger.js

test: fix spelling in test case comments

2018-03-29 23:28:21 -04:00

test-net-get-connections.js

async-hooks,net: ensure asyncId=null if no handle

2017-07-19 15:02:10 -04:00

test-no-assert-when-disabled.js

async_hooks: skip runtime checks when disabled

2017-10-23 17:18:17 -04:00

test-pipeconnectwrap.js

test: move tmpdir to submodule of common

2018-03-29 23:28:22 -04:00

test-pipewrap.js

child_process: fix stdio sockets creation

2018-08-16 11:38:53 +10:00

test-promise.chain-promise-before-init-hooks.js

test: use common.crashOnUnhandledRejection

2017-12-20 01:59:12 +00:00

test-promise.js

test: use common.crashOnUnhandledRejection

2017-12-20 01:59:14 +00:00

test-promise.promise-before-init-hooks.js

test: show incorrect value on test failure

2017-11-16 18:17:57 -05:00

test-querywrap.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-shutdownwrap.js

net: use _final instead of on('finish')

2018-08-16 11:38:51 +10:00

test-signalwrap.js

test: fix unreliable async-hooks/test-signalwrap

2018-08-16 11:38:48 +10:00

test-statwatcher.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-tcpwrap.js

test: remove common.PORT from parallel tests

2018-04-12 01:11:36 +01:00

test-timerwrap.setInterval.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-timerwrap.setTimeout.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-tlswrap.js

test: fix flaky async-hooks/test-tlswrap

2017-10-11 02:05:42 -04:00

test-ttywrap.readstream.js

test,async_hooks: skip whether TTY is available

2017-07-19 15:02:29 -04:00

test-ttywrap.writestream.js

test,async_hooks: match test-ttywrap.readstream

2017-07-19 15:02:30 -04:00

test-udpsendwrap.js

src,lib,test,doc: correct misspellings

2017-07-18 19:56:18 +02:00

test-udpwrap.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

test-writewrap.js

test: remove common.PORT from parallel tests

2018-04-12 01:11:36 +01:00

test-zlib.zlib-binding.deflate.js

async_hooks: rename currentId and triggerId

2017-07-11 19:16:37 +02:00

testcfg.py

…

tick.js

…

verify-graph.js

test: fix spelling in test case comments

2018-03-29 23:28:21 -04:00