mirror of https://github.com/nodejs/node.git
051154e0e6
Duplicate `Transfer-Encoding` header should be a treated as a single, but with original header values concatenated with a comma separator. In the light of this, even if the past `Transfer-Encoding` ended with `chunked`, we should be not let the `F_CHUNKED` to leak into the next header, because mere presence of another header indicates that `chunked` is not the last transfer-encoding token. CVE-ID: CVE-2020-8287 Refs: https://github.com/nodejs-private/llhttp-private/pull/3 Refs: https://hackerone.com/bugs?report_id=1002188&subject=nodejs PR-URL: https://github.com/nodejs-private/node-private/pull/228 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> |
||
|---|---|---|
| .. | ||
| acorn | ||
| acorn-plugins | ||
| brotli | ||
| cares | ||
| cjs-module-lexer | ||
| histogram | ||
| icu-small | ||
| llhttp | ||
| nghttp2 | ||
| nghttp3 | ||
| ngtcp2 | ||
| node-inspect | ||
| npm | ||
| openssl | ||
| uv | ||
| uvwasi | ||
| v8 | ||
| zlib | ||