[GUI] One request with an empty or malformed Host header kills the whole App Host process
Maintainers usually reply within 3 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- javascript, node.js
- Domain
- backend
Research direction
Start in apps/host/server/index.mjs, where the request URL is built from req.headers.host near line 956, before the handler's try block that begins around line 969. Check how an empty or invalid Host header makes new URL throw outside that try. The fix should turn a malformed Host into a 400 or a tolerated parse, so the process stays alive. Done means sending one raw request with an empty Host header leaves the App Host process running and responding.
Written by the indexing model from the issue text.
Description
Problem: apps/host/server/index.mjs builds new URL(req.url ?? '/', http://${req.headers.host ?? 'localhost'}) at line 956, OUTSIDE the handler's try (which starts at line 969). ?? 'localhost' only guards a MISSING Host; an empty (Host: on a raw line) or URL-invalid value (Host: a b) makes new URL throw a TypeError inside the async handler. There is no unhandledRejection handler anywhere in apps/host (grep found none; host-bootstrap.cjs "intentionally does nothing else"), and Node throws on unhandled rejections by default since v15 — so the rejection takes down the entire desktop backend (UI API, agent bridge, engine supervision).
Environment:
Strata Version: 0.2.7 (source checkout at tag v0.2.7, commit 5e8a4cca; the file discussed is byte-identical to the tag)
OS: Linux x86-64
Runtime: Node 26.12.1 for the probe
Reported from the Strata-Mnemosyne fork's merged tree; the offending code is upstream's own.
Reproduce: send a request whose Host header is present but empty (Host: ) to the App Host port. Measured here: the handler shape run standalone in Node 26.12.1 printed UNHANDLED REJECTION: Invalid URL and exited; new URL("/", "http://") and new URL("/", "http://a b") both throw, while new URL('/','http://[::1]:80') works, so IPv6 clients are safe.
Expected: a 400 (or a tolerated parse) and a live host.
Actual: unhandled rejection; on Node >= 15 defaults, process exit.
Reproduction status: mechanism measured standalone in Node; end-to-end against the packaged desktop host NOT run (no desktop app on this box). What would verify: start the app host, send one raw request with an empty Host, watch the host process exit.
- Dominant language
- C++
- Stars
- 11.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Niko1221/Strata
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 3 days
-
[TUI] One unreadable profile file blinds kept_key(): strata launch silently mints a NEW API keyOpen
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 3 days
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
sandialabs/Fenix#172 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
scp-fs2open/fs2open.github.com#7953 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
SteveMacenski/slam_toolbox#907 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day