From 9947fd92329ba6bde6b01fb8497ed4c03b4e2d7d Mon Sep 17 00:00:00 2001 From: Steve Herzog Date: Fri, 17 Feb 2023 11:11:17 -0600 Subject: [PATCH] http: fix validation of "Link" header Updated regex for "Link" header validation to better match the specification in RFC 8288 section 3. Does not check for valid URI format but handles the rest of the header more permissively than before. Alternative to another outstanding PR that disables validation entirely. Fixes: https://github.com/nodejs/node/issues/46453 Refs: https://www.rfc-editor.org/rfc/rfc8288.html#section-3 Refs: https://github.com/nodejs/node/pull/46464 --- lib/internal/validators.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/internal/validators.js b/lib/internal/validators.js index 8127bd66fe3609..59b4700f1d316d 100644 --- a/lib/internal/validators.js +++ b/lib/internal/validators.js @@ -459,7 +459,7 @@ function validateUnion(value, name, union) { } } -const linkValueRegExp = /^(?:<[^>]*>;)\s*(?:rel=(")?[^;"]*\1;?)\s*(?:(?:as|anchor|title|crossorigin|disabled|fetchpriority|rel|referrerpolicy)=(")?[^;"]*\2)?$/; +const linkValueRegExp = /^(?:<[^>]*>)(?:\s*;\s*[^;"]+(?:=(")?[^;"]*\1)?)*$/; /** * @param {any} value