Skip to content

Commit 97fc9b0

Browse files
mcollinamarco-ippolito
mcollina
authored and
marco-ippolito
committed
deps: update undici to 6.23.0
PR-URL: nodejs-private/node-private#792 Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>
1 parent 6059981 commit 97fc9b0

File tree

6 files changed

+38
-24
lines changed

6 files changed

+38
-24
lines changed

‎deps/undici/src/README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -329,7 +329,13 @@ const headers = await fetch(url, { method: 'HEAD' })
329329

330330
The [Fetch Standard](https://fetch.spec.whatwg.org) requires implementations to exclude certain headers from requests and responses. In browser environments, some headers are forbidden so the user agent remains in full control over them. In Undici, these constraints are removed to give more control to the user.
331331

332-
### `undici.upgrade([url, options]): Promise`
332+
#### Content-Encoding
333+
334+
* https://www.rfc-editor.org/rfc/rfc9110#field.content-encoding
335+
336+
Undici limits the number of `Content-Encoding` layers in a response to **5** to prevent resource exhaustion attacks. If a server responds with more than 5 content-encodings (e.g., `Content-Encoding: gzip, gzip, gzip, gzip, gzip, gzip`), the fetch will be rejected with an error. This limit matches the approach taken by [curl](https://curl.se/docs/CVE-2022-32206.html) and [urllib3](https://github.com/advisories/GHSA-gm62-xv2j-4rw9).
337+
338+
#### `undici.upgrade([url, options]): Promise`
333339

334340
Upgrade to a different protocol. See [MDN - HTTP - Protocol upgrade mechanism](https://developer.mozilla.org/en-US/docs/Web/HTTP/Protocol_upgrade_mechanism) for more details.
335341

‎deps/undici/src/lib/llhttp/wasm_build_env.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11

2-
> undici@6.22.0 prebuild:wasm
2+
> undici@6.23.0 prebuild:wasm
33
> node build/wasm.js --prebuild
44

5-
> docker build --platform=linux/aarch64 -t llhttp_wasm_builder -f /Users/matteo/repos/node/deps/undici/src/build/Dockerfile /Users/matteo/repos/node/deps/undici/src
5+
> docker build --platform=linux/aarch64 -t llhttp_wasm_builder -f /Users/matteo/repos/node-private/deps/undici/src/build/Dockerfile /Users/matteo/repos/node-private/deps/undici/src
66

77

88

9-
> undici@6.22.0 build:wasm
9+
> undici@6.23.0 build:wasm
1010
> node build/wasm.js --docker
1111

12-
> docker run --rm -t --platform=linux/aarch64 --mount type=bind,source=/Users/matteo/repos/node/deps/undici/src/lib/llhttp,target=/home/node/undici/lib/llhttp llhttp_wasm_builder node build/wasm.js
12+
> docker run --rm -t --platform=linux/aarch64 --mount type=bind,source=/Users/matteo/repos/node-private/deps/undici/src/lib/llhttp,target=/home/node/undici/lib/llhttp llhttp_wasm_builder node build/wasm.js
1313

1414

1515
alpine-baselayout-3.4.3-r2

‎deps/undici/src/lib/web/fetch/index.js‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2111,21 +2111,13 @@ async function httpNetworkFetch (
21112111
return
21122112
}
21132113

2114-
/** @type {string[]} */
2115-
let codings = []
21162114
let location = ''
21172115

21182116
const headersList = new HeadersList()
21192117

21202118
for (let i = 0; i < rawHeaders.length; i += 2) {
21212119
headersList.append(bufferToLowerCasedHeaderName(rawHeaders[i]), rawHeaders[i + 1].toString('latin1'), true)
21222120
}
2123-
const contentEncoding = headersList.get('content-encoding', true)
2124-
if (contentEncoding) {
2125-
// https://www.rfc-editor.org/rfc/rfc7231#section-3.1.2.1
2126-
// "All content-coding values are case-insensitive..."
2127-
codings = contentEncoding.toLowerCase().split(',').map((x) => x.trim())
2128-
}
21292121
location = headersList.get('location', true)
21302122

21312123
this.body = new Readable({ read: resume })
@@ -2136,9 +2128,23 @@ async function httpNetworkFetch (
21362128
redirectStatusSet.has(status)
21372129

21382130
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
2139-
if (codings.length !== 0 && request.method !== 'HEAD' && request.method !== 'CONNECT' && !nullBodyStatus.includes(status) && !willFollow) {
2131+
if (request.method !== 'HEAD' && request.method !== 'CONNECT' && !nullBodyStatus.includes(status) && !willFollow) {
2132+
// https://www.rfc-editor.org/rfc/rfc7231#section-3.1.2.1
2133+
const contentEncoding = headersList.get('content-encoding', true)
2134+
// "All content-coding values are case-insensitive..."
2135+
/** @type {string[]} */
2136+
const codings = contentEncoding ? contentEncoding.toLowerCase().split(',') : []
2137+
2138+
// Limit the number of content-encodings to prevent resource exhaustion.
2139+
// CVE fix similar to urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206).
2140+
const maxContentEncodings = 5
2141+
if (codings.length > maxContentEncodings) {
2142+
reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
2143+
return true
2144+
}
2145+
21402146
for (let i = codings.length - 1; i >= 0; --i) {
2141-
const coding = codings[i]
2147+
const coding = codings[i].trim()
21422148
// https://www.rfc-editor.org/rfc/rfc9112.html#section-7.2
21432149
if (coding === 'x-gzip' || coding === 'gzip') {
21442150
decoders.push(zlib.createGunzip({

‎deps/undici/src/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "undici",
3-
"version": "6.22.0",
3+
"version": "6.23.0",
44
"description": "An HTTP/1.1 client, written from scratch for Node.js",
55
"homepage": "https://undici.nodejs.org",
66
"bugs": {

‎deps/undici/undici.js‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11362,23 +11362,25 @@ var require_fetch = __commonJS({
1136211362
if (status < 200) {
1136311363
return;
1136411364
}
11365-
let codings = [];
1136611365
let location = "";
1136711366
const headersList = new HeadersList();
1136811367
for (let i = 0; i < rawHeaders.length; i += 2) {
1136911368
headersList.append(bufferToLowerCasedHeaderName(rawHeaders[i]), rawHeaders[i + 1].toString("latin1"), true);
1137011369
}
11371-
const contentEncoding = headersList.get("content-encoding", true);
11372-
if (contentEncoding) {
11373-
codings = contentEncoding.toLowerCase().split(",").map((x) => x.trim());
11374-
}
1137511370
location = headersList.get("location", true);
1137611371
this.body = new Readable({ read: resume });
1137711372
const decoders = [];
1137811373
const willFollow = location && request.redirect === "follow" && redirectStatusSet.has(status);
11379-
if (codings.length !== 0 && request.method !== "HEAD" && request.method !== "CONNECT" && !nullBodyStatus.includes(status) && !willFollow) {
11374+
if (request.method !== "HEAD" && request.method !== "CONNECT" && !nullBodyStatus.includes(status) && !willFollow) {
11375+
const contentEncoding = headersList.get("content-encoding", true);
11376+
const codings = contentEncoding ? contentEncoding.toLowerCase().split(",") : [];
11377+
const maxContentEncodings = 5;
11378+
if (codings.length > maxContentEncodings) {
11379+
reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`));
11380+
return true;
11381+
}
1138011382
for (let i = codings.length - 1; i >= 0; --i) {
11381-
const coding = codings[i];
11383+
const coding = codings[i].trim();
1138211384
if (coding === "x-gzip" || coding === "gzip") {
1138311385
decoders.push(zlib.createGunzip({
1138411386
// Be less strict when decoding compressed responses, since sometimes

‎src/undici_version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@
22
// Refer to tools/dep_updaters/update-undici.sh
33
#ifndef SRC_UNDICI_VERSION_H_
44
#define SRC_UNDICI_VERSION_H_
5-
#define UNDICI_VERSION "6.22.0"
5+
#define UNDICI_VERSION "6.23.0"
66
#endif // SRC_UNDICI_VERSION_H_

0 commit comments

Comments
 (0)