fix(fetch): ByteString checks & conversion in Headers (nodejs#1560)

lib/fetch/index.js

@@ -1946,8 +1946,8 @@ async function httpNetworkFetch (
 
           const headers = new Headers()
           for (let n = 0; n < headersList.length; n += 2) {
-            const key = headersList[n + 0].toString()
-            const val = headersList[n + 1].toString()
+            const key = headersList[n + 0].toString('latin1')
+            const val = headersList[n + 1].toString('latin1')
 
             if (key.toLowerCase() === 'content-encoding') {
               codings = val.split(',').map((x) => x.trim())

lib/fetch/webidl.js

@@ -388,8 +388,9 @@ webidl.converters.DOMString = function (V, opts = {}) {
   return String(V)
 }
 
+// Check for 0 or more characters outside of the latin1 range.
 // eslint-disable-next-line no-control-regex
-const isNotLatin1 = /[^\u0000-\u00ff]/
+const isLatin1 = /^[\u0000-\u00ff]{0,}$/
 
 // https://webidl.spec.whatwg.org/#es-ByteString
 webidl.converters.ByteString = function (V) {
@@ -399,7 +400,7 @@ webidl.converters.ByteString = function (V) {
 
   // 2. If the value of any element of x is greater than
   //    255, then throw a TypeError.
-  if (isNotLatin1.test(x)) {
+  if (!isLatin1.test(x)) {
     throw new TypeError('Argument is not a ByteString')
   }
 

test/fetch/client-fetch.js

@@ -468,3 +468,35 @@ test('do not decode redirect body', (t) => {
     t.strictSame(JSON.stringify(obj), await body.text())
   })
 })
+
+test('Receiving non-Latin1 headers', async (t) => {
+  const ContentDisposition = [
+    'inline; filename=rock&roll.png',
+    'inline; filename="rock\'n\'roll.png"',
+    'inline; filename="image â\x80\x94 copy (1).png"; filename*=UTF-8\'\'image%20%E2%80%94%20copy%20(1).png',
+    'inline; filename="_å\x9C\x96ç\x89\x87_ð\x9F\x96¼_image_.png"; filename*=UTF-8\'\'_%E5%9C%96%E7%89%87_%F0%9F%96%BC_image_.png',
+    'inline; filename="100 % loading&perf.png"; filename*=UTF-8\'\'100%20%25%20loading%26perf.png'
+  ]
+
+  const server = createServer((req, res) => {
+    for (let i = 0; i < ContentDisposition.length; i++) {
+      res.setHeader(`Content-Disposition-${i + 1}`, ContentDisposition[i])
+    }
+
+    res.end()
+  }).listen(0)
+
+  t.teardown(server.close.bind(server))
+  await once(server, 'listening')
+
+  const url = `http://localhost:${server.address().port}`
+  const response = await fetch(url, { method: 'HEAD' })
+  const cdHeaders = [...response.headers]
+    .filter(([k]) => k.startsWith('content-disposition'))
+    .map(([, v]) => v)
+  const lengths = cdHeaders.map(h => h.length)
+
+  t.same(cdHeaders, ContentDisposition)
+  t.same(lengths, [30, 34, 94, 104, 90])
+  t.end()
+})

test/webidl/converters.js

@@ -183,3 +183,11 @@ test('BufferSource', (t) => {
 
   t.end()
 })
+
+test('ByteString', (t) => {
+  t.doesNotThrow(() => {
+    webidl.converters.ByteString('')
+  })
+
+  t.end()
+})