diff --git a/lib/_http_client.js b/lib/_http_client.js index c07589e9c5da6f..26590b9aec2e23 100644 --- a/lib/_http_client.js +++ b/lib/_http_client.js @@ -40,7 +40,7 @@ function ClientRequest(options, cb) { if (self.agent && self.agent.protocol) expectedProtocol = self.agent.protocol; - if (options.path && / /.test(options.path)) { + if (options.path && /[\u0000-\u0020]/.test(options.path)) { // The actual regex is more like /[^A-Za-z0-9\-._~!$&'()*+,;=/:@]/ // with an additional rule for ignoring percentage-escaped characters // but that's a) hard to capture in a regular expression that performs diff --git a/test/parallel/test-http-client-unescaped-path.js b/test/parallel/test-http-client-unescaped-path.js index e01df255a8042c..2411d0e6be31e2 100644 --- a/test/parallel/test-http-client-unescaped-path.js +++ b/test/parallel/test-http-client-unescaped-path.js @@ -1,9 +1,14 @@ 'use strict'; -var common = require('../common'); -var assert = require('assert'); -var http = require('http'); +const common = require('../common'); +const assert = require('assert'); +const http = require('http'); -assert.throws(function() { - // Path with spaces in it should throw. - http.get({ path: 'bad path' }, common.fail); -}, /contains unescaped characters/); +function* bad() { + for (let i = 0; i <= 32; i += 1) + yield 'bad' + String.fromCharCode(i) + 'path'; +} + +for (const path of bad()) { + assert.throws(() => http.get({ path }, common.fail), + /contains unescaped characters/); +}