From 0092358d00e90d501441a69e2b0562f259b0c218 Mon Sep 17 00:00:00 2001
From: Arsalan Ahmad <arsalanahmad.ars@gmail.com>
Date: Mon, 11 Dec 2023 10:41:23 +0200
Subject: [PATCH] http: handle multi-value content-disposition header

Headers in nodejs can be arrays and current workaround for
content-disposition header do not take this into account.
This change fixes that and makes sure array values are handled
properly.

PR-URL: https://github.com/nodejs/node/pull/50977
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
---
 lib/_http_outgoing.js                         |  9 +++++++-
 .../test-http-server-non-utf8-header.js       | 21 +++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
index bc57cd067507f7..ebb339785d0b0c 100644
--- a/lib/_http_outgoing.js
+++ b/lib/_http_outgoing.js
@@ -552,7 +552,14 @@ function processHeader(self, state, key, value, validate) {
   // https://www.rfc-editor.org/rfc/rfc6266#section-4.3
   // Refs: https://github.com/nodejs/node/pull/46528
   if (isContentDispositionField(key) && self._contentLength) {
-    value = Buffer.from(value, 'latin1');
+    // The value could be an array here
+    if (ArrayIsArray(value)) {
+      for (let i = 0; i < value.length; i++) {
+        value[i] = Buffer.from(value[i], 'latin1');
+      }
+    } else {
+      value = Buffer.from(value, 'latin1');
+    }
   }
 
   if (ArrayIsArray(value)) {
diff --git a/test/parallel/test-http-server-non-utf8-header.js b/test/parallel/test-http-server-non-utf8-header.js
index 331965ae38d0f8..8ce82ac4cada04 100644
--- a/test/parallel/test-http-server-non-utf8-header.js
+++ b/test/parallel/test-http-server-non-utf8-header.js
@@ -26,6 +26,27 @@ const nonUtf8ToLatin1 = Buffer.from(nonUtf8Header).toString('latin1');
   }));
 }
 
+{
+  // Test multi-value header
+  const server = http.createServer(common.mustCall((req, res) => {
+    res.writeHead(200, [
+      'content-disposition',
+      [Buffer.from(nonUtf8Header).toString('binary')],
+    ]);
+    res.end('hello');
+  }));
+
+  server.listen(0, common.mustCall(() => {
+    http.get({ port: server.address().port }, (res) => {
+      assert.strictEqual(res.statusCode, 200);
+      assert.strictEqual(res.headers['content-disposition'], nonUtf8ToLatin1);
+      res.resume().on('end', common.mustCall(() => {
+        server.close();
+      }));
+    });
+  }));
+}
+
 {
   const server = http.createServer(common.mustCall((req, res) => {
     res.writeHead(200, [