URIError: URI malformed

[孟祥宇]

Hi All,

We have two problems.

1. We got errors in our node app and it crashed. Error messages are: 

URIError: URI malformed
at decodeURIComponent (native)
at Object.parseCookie (/srv/data/server/node-v0.4.2/lib/node/.npm/connect/1.0.6/package/lib/utils.js:108:18)
at Object.cookieParser [as handle] (/srv/data/server/node-v0.4.2/lib/node/.npm/connect/1.0.6/package/lib/middleware/cookieParser.js:39:29)
at next (/srv/data/server/node-v0.4.2/lib/node/.npm/connect/1.0.6/package/lib/http.js:204:15)
at Object.bodyParser [as handle] (/srv/data/server/node-v0.4.2/lib/node/.npm/connect/1.0.6/package/lib/middleware/bodyParser.js:76:7)
at next (/srv/data/server/node-v0.4.2/lib/node/.npm/connect/1.0.6/package/lib/http.js:204:15)
at Object.methodOverride [as handle] (/srv/data/server/node-v0.4.2/lib/node/.npm/connect/1.0.6/package/lib/middleware/methodOverride.js:35:5)
at next (/srv/data/server/node-v0.4.2/lib/node/.npm/connect/1.0.6/package/lib/http.js:204:15)
at Object.handle (/srv/data/server/node-v0.4.2/lib/node/.npm/express/2.0.0rc/package/lib/http.js:73:5)
at next (/srv/data/server/node-v0.4.2/lib/node/.npm/connect/1.0.6/package/lib/http.js:204:15)

I have two questions here: 1). what condition does this error happen? 2) how can we protect our app from crashing at this error?

2. Our app is running behind a nginx proxy. After some period, the app will have no response and timeout, nginx returns a 504 error. Do you have similar problems?

---

Regards,

Shawn Meng

Blog: mengxy.net

Twitter: @mengxy

[Bradley Meck]

For the first one:

It happens when the builtin (to v8) decodeURIComponent (https://developer.mozilla.org/en/JavaScript/Reference/Global_Objects/decodeURIComponent)  is called with a non-sensical url like:

decodeURIComponent ("localhost?q=%")

Which makes no sense. If you could provide the input given to this we might be able to deduce a way to provide url parsing checks for this example.

For the second one:

Something has caused node to stop responding, can be tricky to debug without more info.

[Shawn Meng]

We have debug for sometime and it seems that cookie parser function in "connect" have some bugs. Here is the gist of that function: https://gist.github.com/879088. Could u plz help to review the code?

We have added cookie-logger function in our app and will follow-up what kind of cookie will crash the function.

-- 
@mengxy
Sent with Sparrow

--
You received this message because you are subscribed to the Google Groups "nodejs" group.
To post to this group, send email to nod...@googlegroups.com.
To unsubscribe from this group, send email to nodejs+un...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/nodejs?hl=en.

[Bradley Meck]

Well the problem appears to be expecting cookies in url encoded strings, the RFCs for http cookies do not provide any limitation on key/values except names must not start with $ and values must be non-whitespace ascii. Because of this many times people want whitespace / unicode cookies are url encoded, however, this may not be. Ripping out:

obj[key] = decodeURIComponent(val.replace(/\+/g, ' '));

For

obj[key] = val

Would be more to spec, but might cause some compatibility issues. I would recommend a try catch that falls back to latter for now. I will discuss with the Connect team about this.

Cheers,

Brad

[Shawn Meng]

Thanks Brad, have u discussed the problem with connection team, when can this patch merged to npm source?

--
Frontend Engineer @ imeigu
Sent with Sparrow

[Bradley Meck]

I have, they have been notified and agreed to put it in a try catch, so I left it at that. Looking at the current codebase out there, there have not pushed the change to npm.

[Bradley Meck]

as a side note in lib/utils.js is the only line that needs changing

obj[key] = decodeURIComponent(val.replace(/\+/g, ' '));

becomes

try{

obj[key] = decodeURIComponent(val.replace(/\+/g, ' '));

}
catch(e) {

obj[key] = val;

}