Skip to content

Commit

Permalink
http: fix non-string header value concatenation
Browse files Browse the repository at this point in the history
Since headers are stored in an empty literal object ({}) instead
of an object created with Object.create(null), care must be taken
with property names inherited from Object. Currently there are
only functions inherited, so we can safely check for existing
strings instead.

Fixes: #4456
PR-URL: #4460
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Minwoo Jung <jmwsoft@gmail.com>
  • Loading branch information
mscdex authored and Myles Borins committed Feb 15, 2016
1 parent 437d0e3 commit 1bb2967
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 2 deletions.
2 changes: 1 addition & 1 deletion lib/_http_incoming.js
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@ IncomingMessage.prototype._addHeaderLine = function(field, value, dest) {

default:
// make comma-separated list
if (dest[field] !== undefined) {
if (typeof dest[field] === 'string') {
dest[field] += ', ' + value;
} else {
dest[field] = value;
Expand Down
6 changes: 5 additions & 1 deletion test/parallel/test-http-server-multiheaders.js
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ var srv = http.createServer(function(req, res) {
assert.equal(req.headers['x-bar'], 'banjo, bango');
assert.equal(req.headers['sec-websocket-protocol'], 'chat, share');
assert.equal(req.headers['sec-websocket-extensions'], 'foo; 1, bar; 2, baz');
assert.equal(req.headers['constructor'], 'foo, bar, baz');

res.writeHead(200, {'Content-Type' : 'text/plain'});
res.end('EOF');
Expand Down Expand Up @@ -48,7 +49,10 @@ srv.listen(common.PORT, function() {
['sec-websocket-protocol', 'share'],
['sec-websocket-extensions', 'foo; 1'],
['sec-websocket-extensions', 'bar; 2'],
['sec-websocket-extensions', 'baz']
['sec-websocket-extensions', 'baz'],
['constructor', 'foo'],
['constructor', 'bar'],
['constructor', 'baz'],
]
});
});

0 comments on commit 1bb2967

Please sign in to comment.