Fetch: reject unsafe request targets

Reject raw C0 control bytes, space, and DEL in the parsed request target
before fetch request serialization.  Leave percent-encoded bytes unchanged.

diff --git a/nginx/ngx_js_fetch.c b/nginx/ngx_js_fetch.c
index 10219545f71b45c560de607dc27443e3f30bf16b..b1bf55eca854c15924c3fce1fa0a5646bf39ac25 100644 (file)
--- a/nginx/ngx_js_fetch.c
+++ b/nginx/ngx_js_fetch.c
@@ -627,6 +627,11 @@ ngx_js_ext_fetch(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
         resolve_host = &u.host;
     }
 
+    if (ngx_js_check_request_line_component(u.uri.data, u.uri.len) != NGX_OK) {
+        njs_vm_error(vm, "invalid url");
+        goto fail;
+    }
+
     ngx_js_fetch_build_request(http, &request, &u.uri, &u,
                                ngx_js_http_proxy(http) && !ngx_js_https(&u));
 

diff --git a/nginx/ngx_qjs_fetch.c b/nginx/ngx_qjs_fetch.c
index 3a41a78c22d8468504bf9f61bee6c97382bd210e..ec7ac08af53337c5f11e42cd01eb65eafb7df4b3 100644 (file)
--- a/nginx/ngx_qjs_fetch.c
+++ b/nginx/ngx_qjs_fetch.c
@@ -364,6 +364,11 @@ ngx_qjs_ext_fetch(JSContext *cx, JSValueConst this_val, int argc,
         resolve_host = &u.host;
     }
 
+    if (ngx_js_check_request_line_component(u.uri.data, u.uri.len) != NGX_OK) {
+        JS_ThrowInternalError(cx, "invalid url");
+        goto fail;
+    }
+
     ngx_js_fetch_build_request(http, &request, &u.uri, &u,
                                ngx_js_http_proxy(http) && !ngx_js_https(&u));
 

diff --git a/nginx/t/js_fetch_objects.t b/nginx/t/js_fetch_objects.t
index 1bc0ef9396dff4ef135ea4a53d12fce6af283b4f..8bf9cf1de6d9f097abefb219c3a2513361c453af 100644 (file)
--- a/nginx/t/js_fetch_objects.t
+++ b/nginx/t/js_fetch_objects.t
@@ -73,6 +73,10 @@ http {
             return 200 $http_a;
         }
 
+        location /target {
+            return 200 $request_uri;
+        }
+
         location /body {
             js_content test.body;
         }
@@ -566,6 +570,30 @@ $t->write_file('test.js', <<EOF);
                 var body = await r.text();
                 return `\${r.url}: \${r.status} \${body}`;
              }, 'http://127.0.0.1:$p0/body: 201 foo'],
+            ['unsafe request target', async () => {
+                const unsafe = [0, 9, 10, 13, 32, 127];
+
+                for (var i = 0; i < unsafe.length; i++) {
+                    try {
+                        await ngx.fetch('http://127.0.0.1:$p0/a'
+                                        + String.fromCharCode(unsafe[i]) + 'b');
+                        throw new Error('no error');
+
+                    } catch (e) {
+                        if (e.message != 'invalid url') {
+                            throw e;
+                        }
+                    }
+                }
+
+                return 'OK';
+             }, 'OK'],
+            ['encoded request target', async () => {
+                var r = await ngx.fetch('http://127.0.0.1:$p0/'
+                                        + 'target%0D%0A?q=%00%20');
+                var body = await r.text();
+                return `\${r.status} \${body}`;
+             }, '200 /target%0D%0A?q=%00%20'],
         ];
 
         run(r, tests);