fix: validate error-derived status codes to prevent process crash (DoS)#122
Merged
Conversation
A thrown error carrying a numeric status/code/statusCode outside the valid HTTP range (100-999) was passed straight to res.statusCode, which throws 'RangeError: Invalid status code' inside the error handler. The exception propagated as an uncaughtException and terminated the process, turning a single request into a full outage (e.g. err.code = 99 as set by some libraries). Add toHttpStatusCode() in libs/utils.js and apply it at all three status-code sinks: the default error handler (index.js), parseErr and the res.send(data, code) path via beforeEnd (libs/response-extensions.js). Regression tests: specs/security.test.js SEC-005/SEC-005b cover out-of-range, oversized and non-integer codes for both custom and default error handlers, plus a server-liveness check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A thrown error carrying a numeric
status/code/statusCodeoutside the valid HTTP range (100–999) was passed straight tores.statusCode, which throwsRangeError: Invalid status codeinside the error handler. That exception propagates as anuncaughtExceptionand terminates the process — a single request becomes a full outage. Realistic trigger: libraries that set numeric non-HTTP codes on their errors (e.g.err.code = 99), orerr.status = 12345.Fix
New
toHttpStatusCode()helper inlibs/utils.js(accepts only integers in 100–999, otherwise falls back) applied at all three status-code sinks:index.js— default error handlerlibs/response-extensions.js—parseErr(theres.send(err)path)libs/response-extensions.js—beforeEnd, guarding theres.send(data, code)argument (falls back to the already-setres.statusCode)Tests
SEC-005/SEC-005binspecs/security.test.js: out-of-range (99), oversized (12345) and non-integer codes, via both custom (res.send(err)) and default error handlers, plus a server-liveness check after the bad requests.500 {"code":500,"message":"Internal Server Error"}and the process stays up.standardlint clean.Found during a security review of the framework; full findings document is intentionally kept local and not part of this PR.