[PR] Harden Node.js WebSocket server handling [thrift]

["Jens-G (via GitHub)" <gi...@apache.org>]

Jens-G opened a new pull request, #3391:
URL: https://github.com/apache/thrift/pull/3391

   Client: nodejs
   
   - Validate origin on WebSocket upgrade using the same CORS rules as HTTP requests
   - Fix path containment check to use trailing separator
   - Replace deprecated new Buffer() with Buffer.alloc()
   - Sanitize interpolated header values in upgrade response
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@thrift.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Harden Node.js WebSocket server handling [thrift]

["Jens-G (via GitHub)" <gi...@apache.org>]

Jens-G closed pull request #3391: Harden Node.js WebSocket server handling
URL: https://github.com/apache/thrift/pull/3391


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@thrift.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Harden Node.js WebSocket server handling [thrift]

["jimexist (via GitHub)" <gi...@apache.org>]

jimexist commented on code in PR #3391:
URL: https://github.com/apache/thrift/pull/3391#discussion_r3068159997


##########
lib/nodejs/lib/thrift/web_server.js:
##########
@@ -557,6 +566,10 @@ exports.createWebServer = function (options) {
         request.headers["sec-websocket-key"] +
           "258EAFA5-E914-47DA-95CA-C5AB0DC85B11",
       );
+      //Sanitize header values to prevent CRLF injection
+      var origin = (request.headers.origin || "").replace(/[\r\n]/g, "");
+      var host = (request.headers.host || "").replace(/[\r\n]/g, "");
+      var reqUrl = (request.url || "").replace(/[\r\n]/g, "");

Review Comment:
   can have a dedicated function to do this



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org