feat: validate incoming host header (#163)

* feat(request): add RequestError class and its utility function

* fix: return 400 if host header is missing or contains invalid characters

* feat: validate incoming host header

* test: add tests for invalid host header

* feat: use options.hostname as default hostname for request

src/index.ts

@@ -1,3 +1,4 @@
 export { serve, createAdaptorServer } from './server'
 export { getRequestListener } from './listener'
+export { RequestError } from './request'
 export type { HttpBindings, Http2Bindings } from './types'

src/listener.ts

@@ -1,6 +1,11 @@
 import type { IncomingMessage, ServerResponse, OutgoingHttpHeaders } from 'node:http'
 import type { Http2ServerRequest, Http2ServerResponse } from 'node:http2'
-import { getAbortController, newRequest, Request as LightweightRequest } from './request'
+import {
+ getAbortController,
+ newRequest,
+ Request as LightweightRequest,
+ toRequestError,
+} from './request'
 import { cacheKey, getInternalBody, Response as LightweightResponse } from './response'
 import type { CustomErrorHandler, FetchCallback, HttpBindings } from './types'
 import { writeFromReadableStream, buildOutgoingHttpHeaders } from './utils'
@@ -10,6 +15,11 @@ import './globals'
 const regBuffer = /^no$/i
 const regContentType = /^(application\/json\b|text\/(?!event-stream\b))/i
 
+const handleRequestError = (): Response =>
+ new Response(null, {
+ status: 400,
+ })
+
 const handleFetchError = (e: unknown): Response =>
  new Response(null, {
  status:
@@ -140,6 +150,7 @@ const responseViaResponseObject = async (
 export const getRequestListener = (
  fetchCallback: FetchCallback,
  options: {
+ hostname?: string
  errorHandler?: CustomErrorHandler
  overrideGlobalObjects?: boolean
  } = {}
@@ -157,12 +168,13 @@ export const getRequestListener = (
  incoming: IncomingMessage | Http2ServerRequest,
  outgoing: ServerResponse | Http2ServerResponse
  ) => {
- let res
+ // eslint-disable-next-line @typescript-eslint/no-explicit-any
+ let res, req: any
 
  try {
  // `fetchCallback()` requests a Request object, but global.Request is expensive to generate,
  // so generate a pseudo Request object with only the minimum required information.
- const req = newRequest(incoming)
+ req = newRequest(incoming, options.hostname)
 
  // Detect if request was aborted.
  outgoing.on('close', () => {
@@ -181,10 +193,12 @@ export const getRequestListener = (
  } catch (e: unknown) {
  if (!res) {
  if (options.errorHandler) {
- res = await options.errorHandler(e)
+ res = await options.errorHandler(req ? e : toRequestError(e))
  if (!res) {
  return
  }
+ } else if (!req) {
+ res = handleRequestError()
  } else {
  res = handleFetchError(e)
  }

src/request.ts

@@ -6,6 +6,25 @@ import { Http2ServerRequest } from 'node:http2'
 import { Readable } from 'node:stream'
 import type { TLSSocket } from 'node:tls'
 
+export class RequestError extends Error {
+ static name = 'RequestError'
+ constructor(
+ message: string,
+ options?: {
+ cause?: unknown
+ }
+ ) {
+ super(message, options)
+ }
+}
+
+export const toRequestError = (e: unknown): RequestError => {
+ if (e instanceof RequestError) {
+ return e
+ }
+ return new RequestError((e as Error).message, { cause: e })
+}
+
 export const GlobalRequest = global.Request
 export class Request extends GlobalRequest {
  constructor(input: string | Request, options?: RequestInit) {
@@ -111,18 +130,35 @@ const requestPrototype: Record<string | symbol, any> = {
 })
 Object.setPrototypeOf(requestPrototype, Request.prototype)
 
-export const newRequest = (incoming: IncomingMessage | Http2ServerRequest) => {
+export const newRequest = (
+ incoming: IncomingMessage | Http2ServerRequest,
+ defaultHostname?: string
+) => {
  const req = Object.create(requestPrototype)
  req[incomingKey] = incoming
- req[urlKey] = new URL(
+
+ const host =
+ (incoming instanceof Http2ServerRequest ? incoming.authority : incoming.headers.host) ||
+ defaultHostname
+ if (!host) {
+ throw new RequestError('Missing host header')
+ }
+ const url = new URL(
  `${
  incoming instanceof Http2ServerRequest ||
  (incoming.socket && (incoming.socket as TLSSocket).encrypted)
  ? 'https'
  : 'http'
- }://${incoming instanceof Http2ServerRequest ? incoming.authority : incoming.headers.host}${
- incoming.url
- }`
- ).href
+ }://${host}${incoming.url}`
+ )
+
+ // check by length for performance.
+ // if suspicious, check by host. host header sometimes contains port.
+ if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, '')) {
+ throw new RequestError('Invalid host header')
+ }
+
+ req[urlKey] = url.href
+
  return req
 }

src/server.ts

@@ -6,6 +6,7 @@ import type { Options, ServerType } from './types'
 export const createAdaptorServer = (options: Options): ServerType => {
  const fetchCallback = options.fetch
  const requestListener = getRequestListener(fetchCallback, {
+ hostname: options.hostname,
  overrideGlobalObjects: options.overrideGlobalObjects,
  })
  // ts will complain about createServerHTTP and createServerHTTP2 not being callable, which works just fine

test/listener.test.ts

@@ -1,28 +1,68 @@
 import { createServer } from 'node:http'
 import request from 'supertest'
 import { getRequestListener } from '../src/listener'
-import { GlobalRequest, Request as LightweightRequest } from '../src/request'
+import { GlobalRequest, Request as LightweightRequest, RequestError } from '../src/request'
 import { GlobalResponse, Response as LightweightResponse } from '../src/response'
 
 describe('Invalid request', () => {
- const requestListener = getRequestListener(jest.fn())
- const server = createServer(async (req, res) => {
- await requestListener(req, res)
+ describe('default error handler', () => {
+  const requestListener = getRequestListener(jest.fn())
+ const server = createServer(requestListener)
 
- if (!res.writableEnded) {
- res.writeHead(500, { 'Content-Type': 'text/plain' })
- res.end('error handler did not return a response')
- }
+ it('Should return server error for a request w/o host header', async () => {
+ const res = await request(server).get('/').set('Host', '').send()
+ expect(res.status).toBe(400)
+ })
+
+ it('Should return server error for a request invalid host header', async () => {
+ const res = await request(server).get('/').set('Host', 'a b').send()
+ expect(res.status).toBe(400)
+ })
  })
 
- it('Should return server error for a request w/o host header', async () => {
- const res = await request(server).get('/').set('Host', '').send()
- expect(res.status).toBe(500)
+ describe('custom error handler', () => {
+ const requestListener = getRequestListener(jest.fn(), {
+ errorHandler: (e) => {
+ if (e instanceof RequestError) {
+ return new Response(e.message, { status: 400 })
+ } else {
+ return new Response('unknown error', { status: 500 })
+ }
+ },
+ })
+ const server = createServer(requestListener)
+
+ it('Should return server error for a request w/o host header', async () => {
+ const res = await request(server).get('/').set('Host', '').send()
+ expect(res.status).toBe(400)
+ })
+
+ it('Should return server error for a request invalid host header', async () => {
+ const res = await request(server).get('/').set('Host', 'a b').send()
+ expect(res.status).toBe(400)
+ })
+
+ it('Should return server error for host header with path', async () => {
+ const res = await request(server).get('/').set('Host', 'a/b').send()
+ expect(res.status).toBe(400)
+ })
  })
 
- it('Should return server error for a request invalid host header', async () => {
- const res = await request(server).get('/').set('Host', 'a b').send()
- expect(res.status).toBe(500)
+ describe('default hostname', () => {
+ const requestListener = getRequestListener(() => new Response('ok'), {
+ hostname: 'example.com',
+ })
+ const server = createServer(requestListener)
+
+ it('Should return 200 for a request w/o host header', async () => {
+ const res = await request(server).get('/').set('Host', '').send()
+ expect(res.status).toBe(200)
+ })
+
+ it('Should return server error for a request invalid host header', async () => {
+ const res = await request(server).get('/').set('Host', 'a b').send()
+ expect(res.status).toBe(400)
+ })
  })
 })
 

test/request.test.ts

@@ -4,6 +4,7 @@ import {
  Request as LightweightRequest,
  GlobalRequest,
  getAbortController,
+ RequestError,
 } from '../src/request'
 
 Object.defineProperty(global, 'Request', {
@@ -40,30 +41,30 @@ describe('Request', () => {
  expect(req.url).toBe('http://localhost/foo.txt')
  })
 
- it('Should resolve double dots in host header', async () => {
+ it('Should accept hostname and port in host header', async () => {
  const req = newRequest({
  headers: {
- host: 'localhost/..',
+ host: 'localhost:8080',
  },
- url: '/foo.txt',
+ url: '/static/../foo.txt',
  } as IncomingMessage)
  expect(req).toBeInstanceOf(global.Request)
- expect(req.url).toBe('http://localhost/foo.txt')
+ expect(req.url).toBe('http://localhost:8080/foo.txt')
  })
 
  it('should generate only one `AbortController` per `Request` object created', async () => {
  const req = newRequest({
  headers: {
- host: 'localhost/..',
+ host: 'localhost',
  },
- rawHeaders: ['host', 'localhost/..'],
+ rawHeaders: ['host', 'localhost'],
  url: '/foo.txt',
  } as IncomingMessage)
  const req2 = newRequest({
  headers: {
- host: 'localhost/..',
+ host: 'localhost',
  },
- rawHeaders: ['host', 'localhost/..'],
+ rawHeaders: ['host', 'localhost'],
  url: '/foo.txt',
  } as IncomingMessage)
 
@@ -78,6 +79,39 @@ describe('Request', () => {
  expect(z).not.toBe(x)
  expect(z).not.toBe(y)
  })
+
+ it('Should throw error if host header contains path', async () => {
+ expect(() => {
+ newRequest({
+ headers: {
+ host: 'localhost/..',
+ },
+ url: '/foo.txt',
+ } as IncomingMessage)
+ }).toThrow(RequestError)
+ })
+
+ it('Should throw error if host header is empty', async () => {
+ expect(() => {
+ newRequest({
+ headers: {
+ host: '',
+ },
+ url: '/foo.txt',
+ } as IncomingMessage)
+ }).toThrow(RequestError)
+ })
+
+ it('Should throw error if host header contains query parameter', async () => {
+ expect(() => {
+ newRequest({
+ headers: {
+ host: 'localhost?foo=bar',
+ },
+ url: '/foo.txt',
+ } as IncomingMessage)
+ }).toThrow(RequestError)
+ })
  })
 
  describe('GlobalRequest', () => {