Pass --max-http-header-size in supported versions only

Rob--W · May 2, 2020 · 0a3b8e9 · 0a3b8e9
1 parent 2579fb6
commit 0a3b8e9
Showing 1 changed file with 12 additions and 1 deletion.
diff --git a/test/test-memory.js b/test/test-memory.js
@@ -32,8 +32,19 @@ describe('memory usage', function() {
     // Uncomment this if you want to compare the performance of CORS Anywhere
     // with the standard no-op http module.
     // args.push('use-http-instead-of-cors-anywhere');
+    var nodeOptionsArgs = ['--expose-gc'];
+    var nodeMajorV = parseInt(process.versions.node, 10);
+    // Node 11.3.0+, 10.14.0+, 8.14.0+, 6.15.0+ restrict header sizes
+    // (CVE-2018-12121), and need to be passed the --max-http-header-size flag
+    // to not reject large headers.
+    if (nodeMajorV >= 11 ||
+        nodeMajorV === 10 ||
+        nodeMajorV === 8 ||
+        nodeMajorV === 6) {
+      nodeOptionsArgs.push('--max-http-header-size=60000');
+    }
     cors_anywhere_child = fork(cors_module_path, args, {
-      execArgv: ['--expose-gc', '--max-http-header-size=60000'],
+      execArgv: nodeOptionsArgs,
     });
     cors_anywhere_child.once('message', function(cors_url) {
       cors_api_url = cors_url;