diff --git a/.changeset/witty-bees-hope.md b/.changeset/witty-bees-hope.md new file mode 100644 index 000000000000..1d2f408c5aed --- /dev/null +++ b/.changeset/witty-bees-hope.md @@ -0,0 +1,5 @@ +--- +"@sveltejs/kit": patch +--- + +fix: handle whitespace in HTTP Accept header diff --git a/packages/kit/src/utils/http.js b/packages/kit/src/utils/http.js index 739993449579..bfd948d4cbf6 100644 --- a/packages/kit/src/utils/http.js +++ b/packages/kit/src/utils/http.js @@ -9,7 +9,7 @@ export function negotiate(accept, types) { const parts = []; accept.split(',').forEach((str, i) => { - const match = /([^/]+)\/([^;]+)(?:;q=([0-9.]+))?/.exec(str); + const match = /([^/ \t]+)\/([^; \t]+)[ \t]*(?:;[ \t]*q=([0-9.]+))?/.exec(str); // no match equals invalid header — ignore if (match) { diff --git a/packages/kit/src/utils/http.spec.js b/packages/kit/src/utils/http.spec.js index c46c0e921e28..8133b1d459c0 100644 --- a/packages/kit/src/utils/http.spec.js +++ b/packages/kit/src/utils/http.spec.js @@ -6,6 +6,13 @@ test('handle valid accept header value', () => { assert.equal(negotiate(accept, ['text/html']), 'text/html'); }); +test('handle accept values with optional whitespace', () => { + // according to RFC 9110, OWS (optional whitespace, aka a space or horizontal tab) + // can occur before/after the `,` and the `;`. + const accept = 'application/some-thing-else, \tapplication/json \t; q=0.9 ,text/plain;q=0.1'; + assert.equal(negotiate(accept, ['application/json', 'text/plain']), 'application/json'); +}); + test('handle invalid accept header value', () => { const accept = 'text/html,*'; assert.equal(negotiate(accept, ['text/html']), 'text/html');