fix header with underscore character

packages/bun-uws/src/HttpParser.h

@@ -231,12 +231,19 @@ namespace uWS
          * [...] It MUST conform to the field-name syntax defined in Section 5.1,
          * and it SHOULD be restricted to just letters, digits,
          * and hyphen ('-') characters, with the first character being a letter. */
+        static inline bool isFieldNameFirstByte(unsigned char x)
+        {
+            return ((x > '@') & (x < '[')) |
+                   ((x > 96) & (x < '{'));
+        }
+
         static inline bool isFieldNameByte(unsigned char x)
         {
             return (x == '-') |
                    ((x > '/') & (x < ':')) |
-                   ((x > '@') & (x < '[')) |
-                   ((x > 96) & (x < '{'));
+                   isFieldNameFirstByte(x) |
+                   (x == '_') |
+                   (x == '.');
         }
 
         static inline uint64_t hasLess(uint64_t x, uint64_t n)
@@ -271,6 +278,10 @@ namespace uWS
                 memcpy(&word, p, sizeof(uint64_t));
                 if (notFieldNameWord(word))
                 {
+                    if (!isFieldNameFirstByte(*(unsigned char *)p)) {
+                        return (void *)p;
+                    }
+                    *(p++) |= 0x20;
                     while (isFieldNameByte(*(unsigned char *)p))
                     {
                         *(p++) |= 0x20;

test/js/node/http/node-http.test.ts

@@ -1676,3 +1676,91 @@ it("#4415.4 IncomingMessage es5", () => {
   IncomingMessage.call(im, { url: "/foo" });
   expect(im.url).toBe("/foo");
 });
+
+it("#8446 header with underscore", done => {
+  const server = Server((req, res) => {
+    res.end('OK');
+  });
+  server.listen(0, async (_err, host, port) => {
+    try {
+      const res = await fetch(`http://localhost:${port}`, {
+        headers: {
+          "x_foo": "bar",
+        },
+      });
+      expect(res.status).toBe(200);
+      expect(await res.text()).toBe("OK");
+      done();
+    } catch (err) {
+      done(err);
+    } finally {
+      server.close();
+    }
+  });
+})
+
+it("#8446 header with dot", done => {
+  const server = Server((req, res) => {
+    res.end('OK');
+  });
+  server.listen(0, async (_err, host, port) => {
+    try {
+      const res = await fetch(`http://localhost:${port}`, {
+        headers: {
+          "x.foo": "bar",
+        },
+      });
+      expect(res.status).toBe(200);
+      expect(await res.text()).toBe("OK");
+      done();
+    } catch (err) {
+      done(err);
+    } finally {
+      server.close();
+    }
+  });
+})
+
+it("#8446 header start with minus", done => {
+  const server = Server((req, res) => {
+    res.end('OK');
+  });
+  server.listen(0, async (_err, host, port) => {
+    try {
+      const res = await fetch(`http://localhost:${port}`, {
+        headers: {
+          "-x-foo": "bar",
+        },
+        signal: AbortSignal.timeout(500),
+      });
+      expect.unreachable();
+    } catch (err) {
+      expect(err.message).toBe("The operation timed out.");
+      done();
+    } finally {
+      server.close();
+    }
+  });
+})
+
+it("#8446 header start with underscore", done => {
+  const server = Server((req, res) => {
+    res.end('OK');
+  });
+  server.listen(0, async (_err, host, port) => {
+    try {
+      const res = await fetch(`http://localhost:${port}`, {
+        headers: {
+          "_x-foo": "bar",
+        },
+        signal: AbortSignal.timeout(500),
+      });
+      expect.unreachable();
+    } catch (err) {
+      expect(err.message).toBe("The operation timed out.");
+      done();
+    } finally {
+      server.close();
+    }
+  });
+})