No control over response when Content-Length is larger than body length & ECONNABORTED for lower Content-Length than body length

Found 2 issues with Content-Length with body-parser & express

• if body length is 2 and Content-Length is 1, there will always be 400 http status, even if you override it
• if body length is 1 and Content-Length is 2, there will be ECONNABORTED (for max httpServer.timeout), and no control over response at all

example code:

const bodyParser = require('body-parser');
const express = require('express');
const app = express();

app.use(bodyParser.json());
app.use((err, req, res, next) => {
    console.error(err); // it will always log error

    res.sendStatus(500); // it will never override response code
});

const server = app.listen(3000);
server.setTimeout(200);

process.once('SIGINT', () => server.close());

curl for first case:

curl -X POST \
  http://127.0.0.1:3000 \
  -H 'Content-Length: 2' \
  -H 'Content-Type: application/json' \
  -d '{'

curl for second case:

curl -X POST \
  http://127.0.0.1:3000 \
  -H 'Content-Length: 1' \
  -H 'Content-Type: application/json' \
  -d '{}'

Don’t know why I have no control over response in both cases. Timeout is what is worrying me, since it will just hang.

Tested it with:

• node: 10, 9, 8, 7, 6
• body-parser: 1.18.3, 1.18.0, 1.17.0, 1.16.0
• express: 4.16.3

[dougwilson]

Both cases can be replicated without Express / body-parser, making this likely a Node.js issue:

const http = require('http');

const server = http.createServer((req, res) => {
    let chunks = [];
    req.on('data', (c) => chunks.push(c));
    req.on('end', () => {
        res.statusCode = 500;
        res.end();
    });
});

server.listen(3000);
server.setTimeout(200);

process.once('SIGINT', () => server.close());

Let me know if I’m mistaken and I can re-open 👍

[aPoCoMiLogin]

Thanks for the fast reply, I appreciate it!