http: prevent writing to the body when not allowed by HTTP spec#47732

gerrard00 · 2023-04-26T17:38:27Z

An exception with the code ERR_HTTP_BODY_NOT_ALLOWED is thrown if an attempt is made to write to the body of a response when the HTTP spec does not allow the response to contain content.

Request method is HEAD
Response status is 204 or 304

For release notes:

An error is thrown if when writing to an HTTP response which does not allow contents.

nodejs-github-bot · 2023-04-26T17:38:32Z

Review requested:

@nodejs/http
@nodejs/net

github-actions · 2023-04-26T17:55:54Z

The notable-changePRs with changes that should be highlighted in changelogs. label has been added by @mcollina.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment.

mcollina

I'm skeptical we can land this without breaking the ecosystem.

This being said, I would not block this if citgm comes out clean.

An option to restore the previous behavior would be good, too.

gerrard00 · 2023-04-26T18:00:14Z

I'm skeptical we can land this without breaking the ecosystem.
This being said, I would not block this if citgm comes out clean.
An option to restore the previous behavior would be good, too.

I'm eager to learn more, so I'm happy to do another PR to add the option to restore the previous behavior if you can point me to an example.

doc/api/http.md

doc/api/errors.md

marco-ippolito · 2023-04-27T07:32:16Z

What about placing this behind an option? We have done this for breaking changes like #45597 #45982

gerrard00 · 2023-05-01T20:44:01Z

I added an option rejectNonStandardBodyWrites which can be set to false to keep the existing behavior where the writes are ignored.

ShogunPanda

In general LGTM.
I just added a consideration about going semver-minor or semver-major.
I'm requesting changes specifically for the docs error. The rest is non blocking.

doc/api/errors.md

lib/_http_outgoing.js

ShogunPanda · 2023-05-02T08:49:37Z

lib/_http_server.js

+validateBoolean(rejectNonStandardBodyWrites,'options.rejectNonStandardBodyWrites');
+this.rejectNonStandardBodyWrites=rejectNonStandardBodyWrites;
+}else{
+this.rejectNonStandardBodyWrites=true


See my other comment for the fallback value.

Changed as well.

…nStandardBodyWrites

gerrard00 · 2023-05-02T18:37:45Z

@ShogunPanda @mcollina I changed the default value for the option to false as requested.

marco-ippolito · 2023-05-02T18:42:25Z

doc/api/errors.md

+
+### `ERR_HTTP_CONTENT_LENGTH_MISMATCH`
+
+An error is thrown if when writing to an HTTP response which does not allow


This description doesnt match the error

Ah, I see it now. Fixed!

If we respond to a HEAD request with a body, we ignore all writes. However, we must still include all implicit headers. Fixes a regressions introduced in #47732. Signed-off-by: Matteo Collina <[email protected]> PR-URL: #48108 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

PR-URL: #47732 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

If we respond to a HEAD request with a body, we ignore all writes. However, we must still include all implicit headers. Fixes a regressions introduced in #47732. Signed-off-by: Matteo Collina <[email protected]> PR-URL: #48108 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

PR-URL: nodejs#47732 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

If we respond to a HEAD request with a body, we ignore all writes. However, we must still include all implicit headers. Fixes a regressions introduced in nodejs#47732. Signed-off-by: Matteo Collina <[email protected]> PR-URL: nodejs#48108 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

Notable changes: crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: TODO

Notable changes: crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: #48694

Notable changes: crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: #48694

Notable changes: crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 * use WebIDL converters in WebCryptoAPI (Filip Skokan) #46067 deps: * update ada to 2.0.0 (Node.js GitHub Bot) #47339 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) #47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) #46190 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 url: * drop ICU requirement for parsing hostnames (Yagiz Nizipli) #47339 * use ada::url_aggregator for parsing urls (Yagiz Nizipli) #47339 * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: #48694

Notable changes: Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing. Contributed by Yagiz Nizipli and Daniel Lemire in #47339 Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Contributed by Filip Skokan in #46067 crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) #47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) #46190 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 url: * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: #48694

Notable changes: Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing. Contributed by Yagiz Nizipli and Daniel Lemire in #47339 Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Contributed by Filip Skokan in #46067 crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) #47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) #46973 doc: * add ovflowd to collaborators (Claudio Wunder) #47844 * add KhafraDev to collaborators (Matthew Aitken) #47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) #47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) #46190 * (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) #47821 module: * change default resolver to not throw on unknown scheme (Gil Tayar) #47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) #48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (#46929) (Robert Nagy) #46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) #47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) #48078 url: * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #47286 PR-URL: #48694

Notable changes: Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing. Contributed by Yagiz Nizipli and Daniel Lemire in nodejs#47339 Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Contributed by Filip Skokan in nodejs#46067 crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) nodejs#47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) nodejs#46973 doc: * add ovflowd to collaborators (Claudio Wunder) nodejs#47844 * add KhafraDev to collaborators (Matthew Aitken) nodejs#47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) nodejs#47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) nodejs#41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) nodejs#46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) nodejs#47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) nodejs#47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) nodejs#47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) nodejs#46190 * (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) nodejs#47821 module: * change default resolver to not throw on unknown scheme (Gil Tayar) nodejs#47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) nodejs#48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) nodejs#46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) nodejs#47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (nodejs#46929) (Robert Nagy) nodejs#46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) nodejs#48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) nodejs#47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) nodejs#47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) nodejs#47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) nodejs#47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) nodejs#48078 url: * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) nodejs#47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) nodejs#47286 PR-URL: nodejs#48694

If we respond to a HEAD request with a body, we ignore all writes. However, we must still include all implicit headers. Fixes a regressions introduced in nodejs#47732. Signed-off-by: Matteo Collina <[email protected]> PR-URL: nodejs#48108 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

Notable changes: Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing. Contributed by Yagiz Nizipli and Daniel Lemire in nodejs#47339 Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Contributed by Filip Skokan in nodejs#46067 crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) nodejs#47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) nodejs#46973 doc: * add ovflowd to collaborators (Claudio Wunder) nodejs#47844 * add KhafraDev to collaborators (Matthew Aitken) nodejs#47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) nodejs#47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) nodejs#41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) nodejs#46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) nodejs#47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) nodejs#47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) nodejs#47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) nodejs#46190 * (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) nodejs#47821 module: * change default resolver to not throw on unknown scheme (Gil Tayar) nodejs#47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) nodejs#48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) nodejs#46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) nodejs#47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (nodejs#46929) (Robert Nagy) nodejs#46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) nodejs#48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) nodejs#47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) nodejs#47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) nodejs#47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) nodejs#47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) nodejs#48078 url: * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) nodejs#47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) nodejs#47286 PR-URL: nodejs#48694

If we respond to a HEAD request with a body, we ignore all writes. However, we must still include all implicit headers. Fixes a regressions introduced in nodejs#47732. Signed-off-by: Matteo Collina <[email protected]> PR-URL: nodejs#48108 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Paolo Insogna <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>

Notable changes: Ada 2.0 Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url. Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4, while also eliminating the need for the ICU requirement for URL hostname parsing. Contributed by Yagiz Nizipli and Daniel Lemire in nodejs#47339 Web Crypto API Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API. Contributed by Filip Skokan in nodejs#46067 crypto: * update root certificates to NSS 3.89 (Node.js GitHub Bot) nodejs#47659 dns: * (SEMVER-MINOR) expose getDefaultResultOrder (btea) nodejs#46973 doc: * add ovflowd to collaborators (Claudio Wunder) nodejs#47844 * add KhafraDev to collaborators (Matthew Aitken) nodejs#47510 * events: * (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) nodejs#47039 fs: * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) nodejs#41439 * (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) nodejs#47084 * (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) nodejs#46933 http: * (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) nodejs#47732 * (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) nodejs#47723 * (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) nodejs#47405 lib: * (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) nodejs#46190 * (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) nodejs#47821 module: * change default resolver to not throw on unknown scheme (Gil Tayar) nodejs#47824 node-api: * (SEMVER-MINOR) define version 9 (Chengzhong Wu) nodejs#48151 * (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) nodejs#46319 stream: * (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) nodejs#47413 * (SEMVER-MINOR) add setter & getter for default highWaterMark (nodejs#46929) (Robert Nagy) nodejs#46929 test: * unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) nodejs#48078 test_runner: * (SEMVER-MINOR) add shorthands to `test` (Chemi Atlow) nodejs#47909 * (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) nodejs#47686 * (SEMVER-MINOR) execute before hook on test (Chemi Atlow) nodejs#47586 * (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) nodejs#47238 tools: * update LICENSE and license-builder.sh (Santiago Gimeno) nodejs#48078 url: * (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) nodejs#47179 wasi: * (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) nodejs#47286 PR-URL: nodejs#48694

nodejs-github-bot added errors Issues and PRs related to JavaScript errors originated in Node.js core. http Issues or PRs related to the http subsystem. needs-ci PRs that need a full CI run. labels Apr 26, 2023

gerrard00 changed the title ~~http: don't allow writing to the body when not allowed by HTTP spec~~http: prevent writing to the body when not allowed by HTTP specApr 26, 2023

gerrard00 force-pushed the request_method_head_dont_allow_writing_body branch from 03a4615 to a4f5d96Compare April 26, 2023 17:40

gerrard00 mentioned this pull request Apr 26, 2023
If request method is HEAD don't allow writing body bytes. #47480
Closed

ronag approved these changes Apr 26, 2023
View reviewed changes

ronag added the semver-major PRs that contain breaking changes and should be released in the next major version. label Apr 26, 2023

ronag requested a review from mcollina April 26, 2023 17:46

mcollina added notable-change PRs with changes that should be highlighted in changelogs. needs-citgm PRs that need a CITGM CI run. labels Apr 26, 2023

mcollina reviewed Apr 26, 2023
View reviewed changes

gerrard00 force-pushed the request_method_head_dont_allow_writing_body branch from a4f5d96 to 1fd67f0Compare April 26, 2023 18:03

VoltrexKeyva reviewed Apr 26, 2023
View reviewed changes

doc/api/http.mdShow resolvedHide resolved
doc/api/errors.md Outdated Show resolvedHide resolved

gerrard00 force-pushed the request_method_head_dont_allow_writing_body branch from 253996d to d29f5efCompare May 1, 2023 20:27

ShogunPanda requested changes May 2, 2023
View reviewed changes

gerrard00 added 3 commits May 2, 2023 14:12

http: prevent writing to the body when not allowed by HTTP spec
788455b

http: add ERR_HTTP_BODY_NOT_ALLOWED to errors.md
1b8e55a

http: rejecting invalid body writes configurable with option rejectNo…
dd8ff7b
…nStandardBodyWrites

gerrard00 force-pushed the request_method_head_dont_allow_writing_body branch from d29f5ef to 3f1f15dCompare May 2, 2023 18:20

http: set rejectNonStandardBodyWrites option default to false
9c2e7da

gerrard00 force-pushed the request_method_head_dont_allow_writing_body branch from 3f1f15d to 9c2e7daCompare May 2, 2023 18:22

gerrard00 requested a review from ShogunPanda May 2, 2023 18:38

marco-ippolito reviewed May 2, 2023
View reviewed changes

sapphi-red mentioned this pull request Jun 4, 2023
HEAD request to vite dev times out on Node v20.2.0 vitejs/vite#13383
Closed
7 tasks

This was referenced Jun 9, 2023
Body is unusable (undici) nuxt/nuxt#19245
Closed
fix: fix issues with native node fetch unjs/ofetch#245
Merged

danielleadams mentioned this pull request Jul 10, 2023
v18.17.0 release proposal #48694
Merged

ShogunPanda mentioned this pull request May 18, 2024
http module documented default behavior only triggered if undocumented option is set #53035
Closed

jakecastelli mentioned this pull request Jun 9, 2024
doc, http: add rejectNonStandardBodyWrites option, clear its behaviour #53396
Merged

hkleungai mentioned this pull request Apr 20, 2025
feat(node/http): add missing ServerOptions DefinitelyTyped/DefinitelyTyped#72550
Merged
7 tasks


		### `ERR_HTTP_CONTENT_LENGTH_MISMATCH`

		An error is thrown if when writing to an HTTP response which does not allow

Uh oh!

http: prevent writing to the body when not allowed by HTTP spec#47732

http: prevent writing to the body when not allowed by HTTP spec #47732

Uh oh!

Conversation

gerrard00 commented Apr 26, 2023• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Apr 26, 2023• edited by ronag Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsbot commented Apr 26, 2023

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

gerrard00 commented Apr 26, 2023

Uh oh!

Uh oh!

Uh oh!

marco-ippolito commented Apr 27, 2023

Uh oh!

gerrard00 commented May 1, 2023

Uh oh!

ShogunPanda left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ShogunPandaMay 2, 2023

Choose a reason for hiding this comment

Uh oh!

gerrard00May 2, 2023

Choose a reason for hiding this comment

Uh oh!

gerrard00 commented May 2, 2023

Uh oh!

marco-ippolitoMay 2, 2023

Choose a reason for hiding this comment

Uh oh!

gerrard00May 3, 2023

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

gerrard00 commented Apr 26, 2023•
edited
Loading

nodejs-github-bot commented Apr 26, 2023•
edited by ronag
Loading