fix(fetch): prevent __proto__ header from corrupting parsed headers object

packages/fetch/src/headers.test.ts

@@ -19,6 +19,19 @@ it('toStandardHeaders', () => {
   })
 })
 
+it('toStandardHeaders with a __proto__ header', () => {
+  const headers = new Headers()
+
+  headers.append('__proto__', 'polluted')
+  headers.append('content-type', 'application/json')
+
+  const standardHeaders = toStandardHeaders(headers)
+
+  expect(Object.getPrototypeOf(standardHeaders)).toBe(null)
+  expect(Object.getOwnPropertyDescriptor(standardHeaders, '__proto__')?.value).toBe('polluted')
+  expect(standardHeaders['content-type']).toBe('application/json')
+})
+
 it('toFetchHeaders', () => {
   const standardHeaders: StandardHeaders = {
     'content-type': 'application/json',

packages/fetch/src/headers.ts

@@ -4,7 +4,9 @@ import type { StandardHeaders } from '@standardserver/core'
  * Convert fetch headers to standard headers.
  */
 export function toStandardHeaders(headers: Headers): StandardHeaders {
-  const standardHeaders: StandardHeaders = {}
+  // Null prototype so header names like __proto__ become plain own
+  // properties instead of touching the object's prototype.
+  const standardHeaders: StandardHeaders = Object.create(null)
 
   headers.forEach((value, key) => {
     if (Array.isArray(standardHeaders[key])) {