Fixed invalid path in CONNECT method requests.

lib/_http_client.js

@@ -49,14 +49,19 @@ const Agent = require('_http_agent');
 const { Buffer } = require('buffer');
 const { defaultTriggerAsyncIdScope } = require('internal/async_hooks');
 const { URL, urlToOptions, searchParamsSymbol } = require('internal/url');
-const { kOutHeaders, kNeedDrain } = require('internal/http');
+const {
+  kOutHeaders,
+  kNeedDrain,
+  isValidCONNECTPath
+} = require('internal/http');
 const { connResetException, codes } = require('internal/errors');
 const {
   ERR_HTTP_HEADERS_SENT,
   ERR_INVALID_ARG_TYPE,
   ERR_INVALID_HTTP_TOKEN,
   ERR_INVALID_PROTOCOL,
-  ERR_UNESCAPED_CHARACTERS
+  ERR_UNESCAPED_CHARACTERS,
+  ERR_INVALID_ARG_VALUE
 } = codes;
 const { validateInteger } = require('internal/validators');
 const { getTimerDuration } = require('internal/timers');
@@ -197,7 +202,22 @@ function ClientRequest(input, options, cb) {
   }
   this.insecureHTTPParser = insecureHTTPParser;
 
-  this.path = options.path || '/';
+  path = options.path;
+  if (path) {
+    if (method === 'CONNECT') {
+      if (path.startsWith('/')) {
+        // if path is '/'
+        path = path.slice(1) || '/';
+        if (!isValidCONNECTPath(path)) {
+          throw new ERR_INVALID_ARG_VALUE('options.path',
+                                          path,
+                                          'must be a valid host:port combo');
+        }
+      }
+    }
+  }
+  this.path = path || '/';
+
   if (cb) {
     this.once('response', cb);
   }

lib/internal/http.js

@@ -7,6 +7,7 @@ const {
 const { setUnrefTimeout } = require('internal/timers');
 const { PerformanceEntry, notify } = internalBinding('performance');
 
+const VALID_PATH_REGEX = /^[_0-9A-Za-z]+(?:\.[_0-9A-Za-z]+)*\.?:(?:[1-9]|[1-9][0-9]{1,2}|[1-5][0-9]{3}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$/;
 let nowCache;
 let utcCache;
 
@@ -32,6 +33,10 @@ function resetCache() {
   utcCache = undefined;
 }
 
+function isValidCONNECTPath(path) {
+  return VALID_PATH_REGEX.test(path);
+}
+
 class HttpRequestTiming extends PerformanceEntry {
   constructor(statistics) {
     super();
@@ -53,5 +58,6 @@ module.exports = {
   kNeedDrain: Symbol('kNeedDrain'),
   nowDate,
   utcDate,
-  emitStatistics
+  emitStatistics,
+  isValidCONNECTPath
 };

test/parallel/test-http-request-connect-method.js

@@ -0,0 +1,42 @@
+// Flags: --expose-internals
+
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const http = require('http');
+const { isValidCONNECTPath } = require('internal/http');
+
+const server = http.createServer();
+
+server.on('connect', common.mustCall((req, stream) => {
+  assert.strictEqual(req.url, 'example.com:80');
+  stream.end('HTTP/1.1 501 Not Implemented\r\n\r\n');
+}));
+
+server.listen(0);
+
+server.on('listening', common.mustCall(() => {
+  const url = new URL(`http://localhost:${server.address().port}/example.com:80`);
+  let req = http.request(url, { method: 'CONNECT' }).end();
+  // invalid path
+  const invalidPathURL = new URL(`http://localhost:${server.address().port}/example.com`);
+  assert.throws(
+    () => {
+      req = http.request(invalidPathURL, { method: 'CONNECT' }).end();
+    },
+    {
+      code: 'ERR_INVALID_ARG_VALUE',
+      name: 'TypeError',
+      message: /^The argument 'options\.path' must be a valid host:port combo\. Received .+$/
+    }
+  );
+  req.once('connect', common.mustCall((res) => {
+    res.destroy();
+    server.close();
+  }));
+}));
+
+['example.com', 'example.com:0', 'example.com:65536'].forEach((path) => {
+  assert.strictEqual(isValidCONNECTPath(path), false);
+});