fix(http): don't expose body on GET/HEAD requests (#12260)

GET/HEAD requests can't have bodies according to `fetch` spec. This
commit changes the HTTP server to hide request bodies for requests with
GET or HEAD methods.

1 files changed, 6 insertions, 1 deletions

diff --git a/ext/http/01_http.js b/ext/http/01_http.js
index 8c4f08aab..4e6b8fc00 100644
--- a/ext/http/01_http.js
+++ b/ext/http/01_http.js
@@ -93,7 +93,12 @@
       let body = null;
       if (typeof requestRid === "number") {
         SetPrototypeAdd(this.managedResources, requestRid);
-        body = createRequestBodyStream(this, requestRid);
+        // There might be a body, but we don't expose it for GET/HEAD requests.
+        // It will be closed automatically once the request has been handled and
+        // the response has been sent.
+        if (method !== "GET" && method !== "HEAD") {
+          body = createRequestBodyStream(this, requestRid);
+        }
       }
 
       const innerRequest = newInnerRequest(