Repository navigation
fix(http,assert): node:http argument/header/URL validation throws ERR_* (#4907) - #4948
Merged
Merged
Conversation
…_* (#4907) Add the argument/header/URL validation node:http performs, throwing the matching ERR_*-coded error so the corpus' assert.throws(...) cases stop failing with "Missing expected exception". Client (http.request/get, new ClientRequest): method (ERR_INVALID_HTTP_TOKEN), path (ERR_UNESCAPED_CHARACTERS), header field names (ERR_INVALID_HTTP_TOKEN), host-header-as-array (ERR_INVALID_ARG_TYPE), protocol mismatch (ERR_INVALID_PROTOCOL), bare/host-less string URL (ERR_INVALID_URL), insecureHTTPParser/timeout option types (ERR_INVALID_ARG_TYPE). Server (response.rs): res.setHeader/removeHeader throw ERR_HTTP_HEADERS_SENT after headers are sent; setHeader rejects non-token names; res.writeEarlyHints validates its hints argument (ERR_INVALID_ARG_TYPE / ERR_INVALID_ARG_VALUE). assert.throws: expected_error_matches now handles the function-validator form (assert.throws(fn, (err) => ...)) by calling the validator with the thrown error and matching on a strict true return (Node semantics); also covers rejects/doesNotThrow/doesNotReject. 0 regressions: http node-suite 18/18, https 5/5, assert 70/70.
proggeramlug
force-pushed
the
worktree-fix-4907-http-validation
branch
from
June 10, 2026 20:05
a40cb83 to
8b44e58
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4907 (part of #2132).
Adds the argument/header/URL validation
node:httpperforms, throwing the matchingERR_*-coded error so the corpus'assert.throws(...)cases stop failing with "Missing expected exception".Client (
http.request/http.get/new ClientRequest)New
crates/perry-ext-http/src/validation.rs, wired intorequest_common/get_common/request_overload:methodnon-token →TypeError [ERR_INVALID_HTTP_TOKEN](Node's exactMethod must be a valid HTTP token ["…"], raw method)pathchars outside!–ÿ→TypeError [ERR_UNESCAPED_CHARACTERS]ERR_INVALID_HTTP_TOKEN;hostheader as array →ERR_INVALID_ARG_TYPEprotocolmismatch (mailto:/ftp:fromurl.parse, etc.) →TypeError [ERR_INVALID_PROTOCOL]www.nodejs.org,127.0.0.1,http://:80/) →TypeError [ERR_INVALID_URL]insecureHTTPParsernon-boolean /timeoutnon-number →ERR_INVALID_ARG_TYPEServer (
crates/perry-ext-http-server/src/response.rs)res.setHeader→Error [ERR_HTTP_HEADERS_SENT]once sent,TypeError [ERR_INVALID_HTTP_TOKEN]for non-token namesres.removeHeader→Error [ERR_HTTP_HEADERS_SENT]once sentres.writeEarlyHintsvalidateshints→ERR_INVALID_ARG_TYPE/ malformedlink→ERR_INVALID_ARG_VALUEassert.throws function-validator support (
crates/perry-runtime/src/object/assert.rs)The real wall for 3 of the target tests:
assert.throws(fn, (err) => …)always failed "did not match the expected matcher" becauseexpected_error_matchesonly handled regex / plain-object / instanceof matchers and never called a callable validator. It now calls a callableexpectedwith the thrown error and matches on a stricttruereturn (Node's validation-function semantics), trapping any throw the validator raises. Also coversassert.rejects/doesNotThrow/doesNotReject.Validation
Target corpus tests pass (invalid-path-chars, request-invalid-method, client-headers-host-array, client-unescaped-path, client-invalid-path, invalid-urls, url.parse-protocol, client-insecure-http-parser, invalidheaderfield, early-hints-invalid-argument, response-add/remove-header-after-sent).
0 regressions: http node-suite 18/18, https 5/5, assert 70/70.
test-http-client-timeout-optionstill hangs on the pre-existing real-timeout event-loop gap (not a validation issue, out of scope).