Node: HTTP response corrupted with status 400 when URL includes pipe character (`|`)

[hoangsetup]

• Version: v12.1.0 v12.0.0
• Platform: MacOS 10.14.2 - Darwin Kernel Version 18.5.0: Mon Mar 11 20:40:32 PDT 2019; root:xnu-4903.251.3~3/RELEASE_X86_64 x8
  6_64

My code:

index.js

var http = require('http');
var url = require('url');

http.createServer(function (req, res) {
  res.writeHead(200, { 'Content-Type': 'text/html' });
  var q = url.parse(req.url, true).query;
  var search = q.search;
  res.end(search);
}).listen(8080);

Starting command: node index.js

Chrome: Version 74.0.3729.131 (Official Build) (64-bit)

When I try to request to my http service, it is working fine with normal url like
http://localhost:8080/?search=example

But, when the url come to http://localhost:8080/?search=example| or http://localhost:8080/?sea|rch=example . My browser gets back This page isn’t working and HTTP ERROR 400 (the request did not appeared on Network tab of Chrome devtool) .

Try again with curl or Postman, these urls are working fine 🤔

=> When I use older node version like v11.11.0 I don't get any errors.

[addaleax]

Thank you for reporting this bug! It’s an issue that seems to occur because we switched out the HTTP parser library default in Node 12. The good news is that you can use --http-parser=legacy to work around this issue for now, and get consistent behaviour on both v11.x and v12.x.

[addaleax]

Yes, this seems like something that should be fixed in llhttp to me. At least browsers and curl do not percent-encode | in the given example URLs.

/cc @indutny @nodejs/http

[indutny]

/me is on it

[indutny]

:facepalm: I literally missed this single character. Thank you @hoangsetup for catching this!

[indutny]

See: https://github.com/nodejs/llhttp/pull/24