fix: validate blob body content type

Author: mcollina

lib/dispatcher/client-h1.js

@@ -10,6 +10,7 @@ const {
   RequestContentLengthMismatchError,
   ResponseContentLengthMismatchError,
   RequestAbortedError,
+  InvalidArgumentError,
   HeadersTimeoutError,
   HeadersOverflowError,
   SocketError,
@@ -1134,8 +1135,16 @@ function writeH1 (client, request) {
     }
     body = bodyStream.stream
     contentLength = bodyStream.length
-  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-    headers.push('content-type', body.type)
+  } else if (util.isBlobLike(body) && request.contentType == null) {
+    const contentType = body.type
+    if (contentType) {
+      const contentTypeValue = `${contentType}`
+      if (!util.isValidHeaderValue(contentTypeValue)) {
+        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'))
+        return false
+      }
+      headers.push('content-type', contentTypeValue)
+    }
   }
 
   if (body && typeof body.read === 'function') {

test/request-crlf.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const assert = require('node:assert')
 const { tspl } = require('@matteo.collina/tspl')
 const { createServer } = require('node:http')
 const { test, after } = require('node:test')
@@ -34,3 +35,33 @@ test('should validate content-type CRLF Injection', async (t) => {
   }
   await t.completed
 })
+
+test('should validate blob body content-type CRLF Injection', async () => {
+  let receivedRequest = false
+  const server = createServer({ joinDuplicateHeaders: true }, (req, res) => {
+    receivedRequest = true
+    res.statusCode = 200
+    res.end('hello')
+  })
+
+  after(() => server.close())
+
+  server.listen(0)
+
+  await once(server, 'listening')
+
+  class MaliciousBlob extends Blob {
+    get type () {
+      return 'text/html\r\nX-Injected: true'
+    }
+  }
+
+  await assert.rejects(
+    request(`http://localhost:${server.address().port}/endpoint`, {
+      method: 'POST',
+      body: new MaliciousBlob(['hello'])
+    }),
+    (e) => e instanceof errors.InvalidArgumentError && e.message === 'invalid content-type header'
+  )
+  assert.strictEqual(receivedRequest, false)
+})