Provide environment information

Machine agnostic

Describe the bug

Some bots or spammers might send invalid requests with URLs like:

hotmail-com.olc.protection.outlook.com%3A25... 

We've met the above, and here's a 3rd party library showcasing the same signature: https://github.com/sbordeyne/fastapi_spammer_protection/blob/fd4a3982c23cd4ab0f4761c9db603994c06fa19c/fastapi_spammer_protection/vulnerable_urls.py#L174

We've got some auxiliary servers, with exposed IPs, crashed by bots. Our main servers work behing Nginx which prevents the above from happening.

Here's where it happens:

https://github.com/trpc/trpc/blob/next/packages/server/src/adapters/node-http/incomingMessageToRequest.ts#L70

const url = `http://${headers.get('host')}${req.url}`;

The above code is buggy because req.url might be invalid, in particular not starting with a slash! So ${headers.get('host')}${req.url} becomes
something malformed of {domain}{domain} shape.

It leads to a hard crash of the server – it does not just return 400 or 500 or something, but completely stops to accept new connections, basically goes offline❗Some of this behavior might be NodeJS specific, but the issue starts in TRPC code. Couldn't investigate in more details due to the lack of time.

Proposed Solution

Validate that req.url starts with /.

Link to reproduction

I don't have enough time to prepare a sandbox, sorry, maybe a bit later.
It looks like a TRPC bug to me.

To reproduce

Create a server with http-node adapter and send a GET/POST with an invalid URL. E.g.

$ printf 'GET hotmail-com.olc.protection.outlook.com HTTP/1.1\r\nHost: localhost\r\n\r\n' | nc localhost 2000

If anything – I'll contribute a sandbox next week.

Additional information

Copied from:
#6091 (comment)

👨‍👧‍👦 Contributing

• 🙋‍♂️ Yes, I'd be down to file a PR fixing this bug!