Detect and trim any invalid incoming req header name

lib/http-proxy/passes/web-incoming.js

@@ -122,6 +122,22 @@ module.exports = {
       if(!options.target) { return res.end(); }
     }
 
+    // Check incoming req headers if they contain whitespace and modify if true.
+    // Without following modifications it will crash server
+    var reqHeaderKeys = Object.keys(req.headers);
+    for (var i = 0; i < reqHeaderKeys.length; i++) {
+      var reqHeaderKey = reqHeaderKeys[i];
+      if (reqHeaderKey.includes(" ")) {
+        var newHeaderKey = reqHeaderKey.trim();
+        // Replace all whitespaces that are not trimmed with dash (necessary for "foo bar" type of header names)
+        newHeaderKey = newHeaderKey.replace(" ", "-");
+        // Add new header to req headers
+        req.headers[newHeaderKey] = req.headers[reqHeaderKey];
+        // Remove invalid header
+        delete req.headers[reqHeaderKey];
+      }
+    }
+
     // Request initalization
     var proxyReq = (options.target.protocol === 'https:' ? https : http).request(
       common.setupOutgoing(options.ssl || {}, options, req)

test/lib-http-proxy-passes-web-incoming-test.js

@@ -126,6 +126,32 @@ describe('#createProxyServer.web() using own http server', function () {
     http.request('http://127.0.0.1:8081', function() {}).end();
   });
 
+  it('should detect invalid header in req headers and modify header', function (done) {
+    var proxy = httpProxy.createProxyServer({
+      target: 'http://127.0.0.1:8080',
+    });
+
+    function requestHandler(req, res) {
+      // Add invalid header with whitespace
+      req.headers['x-invalid-req-header '] = 'foobar';
+      proxy.web(req, res);
+    }
+
+    var proxyServer = http.createServer(requestHandler);
+
+    var source = http.createServer(function(req, res) {
+      source.close();
+      proxyServer.close();
+      expect(req.headers['x-invalid-req-header']).to.eql('foobar');
+      done();
+    });
+
+    proxyServer.listen('8081');
+    source.listen('8080');
+
+    http.request('http://127.0.0.1:8081', function() {}).end();
+  });
+
   it('should proxy the request and handle error via callback', function(done) {
     var proxy = httpProxy.createProxyServer({
       target: 'http://127.0.0.1:8080'