Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Non-HTTPToken characters can be used in header names #2409

Closed
tsctx opened this issue Nov 8, 2023 · 0 comments · Fixed by #2410
Closed

Non-HTTPToken characters can be used in header names #2409

tsctx opened this issue Nov 8, 2023 · 0 comments · Fixed by #2410
Labels
bug Something isn't working

Comments

@tsctx
Copy link
Member

tsctx commented Nov 8, 2023

Bug Description

The following character "(),/:;<=>?@[\]{} is not allowed in the specification, but is allowed in Undici.

References:
https://fetch.spec.whatwg.org/#header-name
https://tools.ietf.org/html/rfc7230#section-3.2.6
https://tools.ietf.org/html/rfc9110#section-5.6.2

Reproducible By

There is a simple test.

// test.js
function pass(name) {
    try {
        return !!new Headers({ [name]: "test" });
    } catch (e) {
        return false;
    }
}

function assert(cond, message) {
    if (!cond) console.error(message);
}

function test() {
    for (const char of `"(),/:;<=>?@[\\]{}`.split("")) {
        assert(!pass(char), `The string \`${char}\` should throw an error.`);
    }
}

test();

Expected Behavior

The above test should succeed.

Logs & Screenshots

> $ node test.js
The string `"` should throw an error.
The string `(` should throw an error.
The string `)` should throw an error.
The string `,` should throw an error.
The string `/` should throw an error.
The string `:` should throw an error.
The string `;` should throw an error.
The string `<` should throw an error.
The string `=` should throw an error.
The string `>` should throw an error.
The string `?` should throw an error.
The string `@` should throw an error.
The string `[` should throw an error.
The string `\` should throw an error.
The string `]` should throw an error.
The string `{` should throw an error.
The string `}` should throw an error.

Environment

Windows 11
Node.js v21.1.0
Undici v5.27.2

Additional context

None

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant