Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mimesniff: fix many broken tests #2103

Merged
merged 4 commits into from
Apr 30, 2023
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
41 changes: 34 additions & 7 deletions lib/fetch/dataURL.js
Original file line number Diff line number Diff line change
Expand Up @@ -42,14 +42,12 @@ function dataURLProcessor (dataURL) {

// 6. Strip leading and trailing ASCII whitespace
// from mimeType.
// Note: This will only remove U+0020 SPACE code
// points, if any.
// Undici implementation note: we need to store the
// length because if the mimetype has spaces removed,
// the wrong amount will be sliced from the input in
// step #9
const mimeTypeLength = mimeType.length
mimeType = mimeType.replace(/^(\u0020)+|(\u0020)+$/g, '')
mimeType = removeASCIIWhitespace(mimeType, true, true)

// 7. If position is past the end of input, then
// return failure
Expand Down Expand Up @@ -286,17 +284,20 @@ function parseMIMEType (input) {
return 'failure'
}

const typeLowercase = type.toLowerCase()
const subtypeLowercase = subtype.toLowerCase()

// 10. Let mimeType be a new MIME type record whose type
// is type, in ASCII lowercase, and subtype is subtype,
// in ASCII lowercase.
// https://mimesniff.spec.whatwg.org/#mime-type
const mimeType = {
type: type.toLowerCase(),
subtype: subtype.toLowerCase(),
type: typeLowercase,
subtype: subtypeLowercase,
/** @type {Map<string, string>} */
parameters: new Map(),
// https://mimesniff.spec.whatwg.org/#mime-type-essence
essence: `${type}/${subtype}`
essence: `${typeLowercase}/${subtypeLowercase}`
}

// 11. While position is not past the end of input:
Expand Down Expand Up @@ -391,7 +392,7 @@ function parseMIMEType (input) {
if (
parameterName.length !== 0 &&
HTTP_TOKEN_CODEPOINTS.test(parameterName) &&
HTTP_QUOTED_STRING_TOKENS.test(parameterValue) &&
(parameterValue.length === 0 || HTTP_QUOTED_STRING_TOKENS.test(parameterValue)) &&
!mimeType.parameters.has(parameterName)
) {
mimeType.parameters.set(parameterName, parameterValue)
Expand Down Expand Up @@ -591,6 +592,32 @@ function removeHTTPWhitespace (str, leading = true, trailing = true) {
return str.slice(lead, trail + 1)
}

/**
* @see https://infra.spec.whatwg.org/#ascii-whitespace
* @param {string} char
*/
function isASCIIWhitespace (char) {
return char === '\r' || char === '\n' || char === '\t' || char === '\f' || char === ' '
}

/**
* @see https://infra.spec.whatwg.org/#strip-leading-and-trailing-ascii-whitespace
*/
function removeASCIIWhitespace (str, leading = true, trailing = true) {
let lead = 0
let trail = str.length - 1

if (leading) {
for (; lead < str.length && isASCIIWhitespace(str[lead]); lead++);
}

if (trailing) {
for (; trail > 0 && isASCIIWhitespace(str[trail]); trail--);
}

return str.slice(lead, trail + 1)
}

module.exports = {
dataURLProcessor,
URLSerializer,
Expand Down
2 changes: 1 addition & 1 deletion lib/fetch/response.js
Original file line number Diff line number Diff line change
Expand Up @@ -467,7 +467,7 @@ function initializeResponse (response, init, body) {

// 5. If init["headers"] exists, then fill response’s headers with init["headers"].
if ('headers' in init && init.headers != null) {
fill(response[kState].headersList, init.headers)
fill(response[kHeaders], init.headers)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we've had some discussion about this line before, using headersList here was always incorrect, but a workaround for some bugs with data urls. However it'd also bypass header name/header value validation which almost sounds like a vulnerability...

}

// 6. If body was given, then:
Expand Down