Skip to content

Commit

Permalink
http: fix non-string header value concatenation
Browse files Browse the repository at this point in the history
Since headers are stored in an empty literal object ({}) instead
of an object created with Object.create(null), care must be taken
with property names inherited from Object. Currently there are
only functions inherited, so we can safely check for existing
strings instead.

Fixes: #4456
PR-URL: #4460
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>
  • Loading branch information
mscdex authored and Myles Borins committed Feb 11, 2016
1 parent ac1e89b commit 39ef824
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 2 deletions.
2 changes: 1 addition & 1 deletion lib/_http_incoming.js
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@ IncomingMessage.prototype._addHeaderLine = function(field, value, dest) {

default:
// make comma-separated list
if (dest[field] !== undefined) {
if (typeof dest[field] === 'string') {
dest[field] += ', ' + value;
} else {
dest[field] = value;
Expand Down
6 changes: 5 additions & 1 deletion test/parallel/test-http-server-multiheaders.js
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ var srv = http.createServer(function(req, res) {
assert.equal(req.headers['x-bar'], 'banjo, bango');
assert.equal(req.headers['sec-websocket-protocol'], 'chat, share');
assert.equal(req.headers['sec-websocket-extensions'], 'foo; 1, bar; 2, baz');
assert.equal(req.headers['constructor'], 'foo, bar, baz');

res.writeHead(200, {'Content-Type' : 'text/plain'});
res.end('EOF');
Expand Down Expand Up @@ -48,7 +49,10 @@ srv.listen(common.PORT, function() {
['sec-websocket-protocol', 'share'],
['sec-websocket-extensions', 'foo; 1'],
['sec-websocket-extensions', 'bar; 2'],
['sec-websocket-extensions', 'baz']
['sec-websocket-extensions', 'baz'],
['constructor', 'foo'],
['constructor', 'bar'],
['constructor', 'baz'],
]
});
});

0 comments on commit 39ef824

Please sign in to comment.