http: prevent writing to the body when not allowed by HTTP spec #47732

gerrard00 · 2023-04-26T17:38:27Z

An exception with the code ERR_HTTP_BODY_NOT_ALLOWED is thrown if an attempt is made to write to the body of a response when the HTTP spec does not allow the response to contain content.

Request method is HEAD
Response status is 204 or 304

For release notes:

An error is thrown if when writing to an HTTP response which does not allow contents.

nodejs-github-bot · 2023-04-26T17:38:32Z

Review requested:

@nodejs/http
@nodejs/net

github-actions · 2023-04-26T17:55:54Z

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @mcollina.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment.

mcollina

I'm skeptical we can land this without breaking the ecosystem.

This being said, I would not block this if citgm comes out clean.

An option to restore the previous behavior would be good, too.

gerrard00 · 2023-04-26T18:00:14Z

I'm skeptical we can land this without breaking the ecosystem.

This being said, I would not block this if citgm comes out clean.

An option to restore the previous behavior would be good, too.

I'm eager to learn more, so I'm happy to do another PR to add the option to restore the previous behavior if you can point me to an example.

doc/api/http.md

doc/api/errors.md

marco-ippolito · 2023-04-27T07:32:16Z

What about placing this behind an option? We have done this for breaking changes like #45597 #45982

gerrard00 · 2023-05-01T20:44:01Z

I added an option rejectNonStandardBodyWrites which can be set to false to keep the existing behavior where the writes are ignored.

ShogunPanda

In general LGTM.
I just added a consideration about going semver-minor or semver-major.
I'm requesting changes specifically for the docs error. The rest is non blocking.

doc/api/errors.md

lib/_http_outgoing.js

ShogunPanda · 2023-05-02T08:49:37Z

lib/_http_server.js

+    validateBoolean(rejectNonStandardBodyWrites, 'options.rejectNonStandardBodyWrites');
+    this.rejectNonStandardBodyWrites = rejectNonStandardBodyWrites;
+  } else {
+    this.rejectNonStandardBodyWrites = true


See my other comment for the fallback value.

Changed as well.

…nStandardBodyWrites

gerrard00 · 2023-05-02T18:37:45Z

@ShogunPanda @mcollina I changed the default value for the option to false as requested.

marco-ippolito · 2023-05-02T18:42:25Z

doc/api/errors.md

+
+### `ERR_HTTP_CONTENT_LENGTH_MISMATCH`
+
+An error is thrown if when writing to an HTTP response which does not allow


This description doesnt match the error

Ah, I see it now. Fixed!

If we respond to a HEAD request with a body, we ignore all writes. However, we must still include all implicit headers. Fixes a regressions introduced in #47732. Signed-off-by: Matteo Collina <[email protected]> PR-URL: #48108 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

PR-URL: #47732 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

If we respond to a HEAD request with a body, we ignore all writes. However, we must still include all implicit headers. Fixes a regressions introduced in #47732. Signed-off-by: Matteo Collina <[email protected]> PR-URL: #48108 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

PR-URL: nodejs#47732 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

If we respond to a HEAD request with a body, we ignore all writes. However, we must still include all implicit headers. Fixes a regressions introduced in nodejs#47732. Signed-off-by: Matteo Collina <[email protected]> PR-URL: nodejs#48108 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

Notable changes: crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: TODO

Notable changes: crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: #48694

Notable changes: crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: #48694

Notable changes: crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 * use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) #47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) #46190 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: #48694

Notable changes: Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing. Contributed by Yagiz Nizipli and Daniel Lemire in #47339 Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Contributed by Filip Skokan in #46067 crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) #47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) #46190 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 url: * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: #48694

Notable changes: Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing. Contributed by Yagiz Nizipli and Daniel Lemire in #47339 Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Contributed by Filip Skokan in #46067 crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) #47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) #46190 * (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) #47821 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 url: * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: #48694

Notable changes: Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing. Contributed by Yagiz Nizipli and Daniel Lemire in nodejs#47339 Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Contributed by Filip Skokan in nodejs#46067 crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) nodejs#47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) nodejs#46973 doc: * add ovflowd to collaborators (Claudio Wunder) nodejs#47844 * add KhafraDev to collaborators (Matthew Aitken) nodejs#47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) nodejs#47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) nodejs#41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) nodejs#46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) nodejs#47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) nodejs#47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) nodejs#47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) nodejs#46190 * (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) nodejs#47821 module: * change default resolver to not throw on unknown scheme (Gil Tayar) nodejs#47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) nodejs#48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) nodejs#46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) nodejs#47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (nodejs#46929) (Robert Nagy) nodejs#46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) nodejs#48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) nodejs#47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) nodejs#47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) nodejs#47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) nodejs#47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) nodejs#48078 url: * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) nodejs#47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) nodejs#47286 PR-URL: nodejs#48694

If we respond to a HEAD request with a body, we ignore all writes. However, we must still include all implicit headers. Fixes a regressions introduced in nodejs#47732. Signed-off-by: Matteo Collina <[email protected]> PR-URL: nodejs#48108 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

Notable changes: Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing. Contributed by Yagiz Nizipli and Daniel Lemire in nodejs#47339 Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Contributed by Filip Skokan in nodejs#46067 crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) nodejs#47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) nodejs#46973 doc: * add ovflowd to collaborators (Claudio Wunder) nodejs#47844 * add KhafraDev to collaborators (Matthew Aitken) nodejs#47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) nodejs#47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) nodejs#41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) nodejs#46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) nodejs#47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) nodejs#47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) nodejs#47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) nodejs#46190 * (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) nodejs#47821 module: * change default resolver to not throw on unknown scheme (Gil Tayar) nodejs#47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) nodejs#48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) nodejs#46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) nodejs#47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (nodejs#46929) (Robert Nagy) nodejs#46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) nodejs#48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) nodejs#47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) nodejs#47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) nodejs#47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) nodejs#47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) nodejs#48078 url: * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) nodejs#47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) nodejs#47286 PR-URL: nodejs#48694

If we respond to a HEAD request with a body, we ignore all writes. However, we must still include all implicit headers. Fixes a regressions introduced in nodejs#47732. Signed-off-by: Matteo Collina <[email protected]> PR-URL: nodejs#48108 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

Notable changes: Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing. Contributed by Yagiz Nizipli and Daniel Lemire in nodejs#47339 Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Contributed by Filip Skokan in nodejs#46067 crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) nodejs#47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) nodejs#46973 doc: * add ovflowd to collaborators (Claudio Wunder) nodejs#47844 * add KhafraDev to collaborators (Matthew Aitken) nodejs#47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) nodejs#47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) nodejs#41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) nodejs#46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) nodejs#47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) nodejs#47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) nodejs#47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) nodejs#46190 * (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) nodejs#47821 module: * change default resolver to not throw on unknown scheme (Gil Tayar) nodejs#47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) nodejs#48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) nodejs#46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) nodejs#47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (nodejs#46929) (Robert Nagy) nodejs#46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) nodejs#48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) nodejs#47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) nodejs#47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) nodejs#47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) nodejs#47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) nodejs#48078 url: * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) nodejs#47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) nodejs#47286 PR-URL: nodejs#48694

nodejs-github-bot added errors Issues and PRs related to JavaScript errors originated in Node.js core. http Issues or PRs related to the http subsystem. needs-ci PRs that need a full CI run. labels Apr 26, 2023

gerrard00 changed the title ~~http: don't allow writing to the body when not allowed by HTTP spec~~ http: prevent writing to the body when not allowed by HTTP spec Apr 26, 2023

gerrard00 force-pushed the request_method_head_dont_allow_writing_body branch from 03a4615 to a4f5d96 Compare April 26, 2023 17:40

gerrard00 mentioned this pull request Apr 26, 2023

If request method is HEAD don't allow writing body bytes. #47480

Closed

ronag approved these changes Apr 26, 2023

View reviewed changes

ronag added the semver-major PRs that contain breaking changes and should be released in the next major version. label Apr 26, 2023

ronag requested a review from mcollina April 26, 2023 17:46

mcollina added notable-change PRs with changes that should be highlighted in changelogs. needs-citgm PRs that need a CITGM CI run. labels Apr 26, 2023

mcollina reviewed Apr 26, 2023

View reviewed changes

gerrard00 force-pushed the request_method_head_dont_allow_writing_body branch from a4f5d96 to 1fd67f0 Compare April 26, 2023 18:03

VoltrexKeyva reviewed Apr 26, 2023

View reviewed changes

doc/api/http.md Show resolved Hide resolved

doc/api/errors.md Outdated Show resolved Hide resolved

gerrard00 force-pushed the request_method_head_dont_allow_writing_body branch from 253996d to d29f5ef Compare May 1, 2023 20:27

ShogunPanda requested changes May 2, 2023

View reviewed changes

gerrard00 added 3 commits May 2, 2023 14:12

http: prevent writing to the body when not allowed by HTTP spec

788455b

http: add ERR_HTTP_BODY_NOT_ALLOWED to errors.md

1b8e55a

http: rejecting invalid body writes configurable with option rejectNo…

dd8ff7b

…nStandardBodyWrites

gerrard00 force-pushed the request_method_head_dont_allow_writing_body branch from d29f5ef to 3f1f15d Compare May 2, 2023 18:20

http: set rejectNonStandardBodyWrites option default to false

9c2e7da

gerrard00 force-pushed the request_method_head_dont_allow_writing_body branch from 3f1f15d to 9c2e7da Compare May 2, 2023 18:22

gerrard00 requested a review from ShogunPanda May 2, 2023 18:38

marco-ippolito reviewed May 2, 2023

View reviewed changes

sapphi-red mentioned this pull request Jun 4, 2023

HEAD request to vite dev times out on Node v20.2.0 vitejs/vite#13383

Closed

7 tasks

This was referenced Jun 9, 2023

Body is unusable (undici) nuxt/nuxt#19245

Closed

fix: fix issues with native node fetch unjs/ofetch#245

Merged

danielleadams mentioned this pull request Jul 10, 2023

v18.17.0 release proposal #48694

Merged

ShogunPanda mentioned this pull request May 18, 2024

http module documented default behavior only triggered if undocumented option is set #53035

Closed

jakecastelli mentioned this pull request Jun 9, 2024

doc, http: add rejectNonStandardBodyWrites option, clear its behaviour #53396

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

http: prevent writing to the body when not allowed by HTTP spec #47732

http: prevent writing to the body when not allowed by HTTP spec #47732

gerrard00 commented Apr 26, 2023 •

edited

Loading

nodejs-github-bot commented Apr 26, 2023 •

edited by ronag

Loading

github-actions bot commented Apr 26, 2023

mcollina left a comment

gerrard00 commented Apr 26, 2023

marco-ippolito commented Apr 27, 2023

gerrard00 commented May 1, 2023

ShogunPanda left a comment

ShogunPanda May 2, 2023

gerrard00 May 2, 2023

gerrard00 commented May 2, 2023

marco-ippolito May 2, 2023

gerrard00 May 3, 2023


		### `ERR_HTTP_CONTENT_LENGTH_MISMATCH`

		An error is thrown if when writing to an HTTP response which does not allow

http: prevent writing to the body when not allowed by HTTP spec #47732

http: prevent writing to the body when not allowed by HTTP spec #47732

Conversation

gerrard00 commented Apr 26, 2023 • edited Loading

nodejs-github-bot commented Apr 26, 2023 • edited by ronag Loading

github-actions bot commented Apr 26, 2023

mcollina left a comment

Choose a reason for hiding this comment

gerrard00 commented Apr 26, 2023

marco-ippolito commented Apr 27, 2023

gerrard00 commented May 1, 2023

ShogunPanda left a comment

Choose a reason for hiding this comment

ShogunPanda May 2, 2023

Choose a reason for hiding this comment

gerrard00 May 2, 2023

Choose a reason for hiding this comment

gerrard00 commented May 2, 2023

marco-ippolito May 2, 2023

Choose a reason for hiding this comment

gerrard00 May 3, 2023

Choose a reason for hiding this comment

gerrard00 commented Apr 26, 2023 •

edited

Loading

nodejs-github-bot commented Apr 26, 2023 •

edited by ronag

Loading