Skip to content

Commit ba436c6

Browse files
authored
Merge pull request from GHSA-gv7g-x59x-wf8f
* fix: do a case-insensitive comparison when checking header value * changeset * remove export * Update .changeset/happy-pots-move.md
1 parent 23d8327 commit ba436c6

File tree

3 files changed

+9
-3
lines changed

3 files changed

+9
-3
lines changed

.changeset/happy-pots-move.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
'@sveltejs/kit': patch
3+
---
4+
5+
fix: address security advisory CVE-2023-29008 by doing a case-insensitive comparison when checking header value

packages/kit/src/utils/http.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,9 @@ export function negotiate(accept, types) {
5959
* @param {Request} request
6060
* @param {...string} types
6161
*/
62-
export function is_content_type(request, ...types) {
62+
function is_content_type(request, ...types) {
6363
const type = request.headers.get('content-type')?.split(';', 1)[0].trim() ?? '';
64-
return types.includes(type);
64+
return types.includes(type.toLowerCase());
6565
}
6666

6767
/**

packages/kit/test/apps/basics/test/server.test.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,8 @@ test.describe('CSRF', () => {
6161
const content_types = [
6262
'application/x-www-form-urlencoded',
6363
'multipart/form-data',
64-
'text/plain'
64+
'text/plain',
65+
'text/plaiN'
6566
];
6667
const methods = ['POST', 'PUT', 'PATCH', 'DELETE'];
6768
for (const method of methods) {

0 commit comments

Comments
 (0)