fix(ext/fetch): avoid panic when header is invalid (#12244)

1 files changed, 48 insertions, 0 deletions

diff --git a/cli/tests/unit/fetch_test.ts b/cli/tests/unit/fetch_test.ts
index eca62f8eb..5bce2af43 100644
--- a/cli/tests/unit/fetch_test.ts
+++ b/cli/tests/unit/fetch_test.ts
@@ -1299,3 +1299,51 @@ unitTest(
     }
   },
 );
+
+unitTest(
+  { permissions: { net: true } },
+  async function fetchHeaderValueShouldNotPanic() {
+    for (let i = 0; i < 0x21; i++) {
+      if (i === 0x09 || i === 0x0A || i === 0x0D || i === 0x20) {
+        continue; // these header value will be normalized, will not cause an error.
+      }
+      // ensure there will be an error instead of panic.
+      await assertRejects(() =>
+        fetch("http://localhost:4545/echo_server", {
+          method: "HEAD",
+          headers: { "val": String.fromCharCode(i) },
+        }), TypeError);
+    }
+    await assertRejects(() =>
+      fetch("http://localhost:4545/echo_server", {
+        method: "HEAD",
+        headers: { "val": String.fromCharCode(127) },
+      }), TypeError);
+  },
+);
+
+unitTest(
+  { permissions: { net: true } },
+  async function fetchHeaderNameShouldNotPanic() {
+    const validTokens =
+      "!#$%&'*+-.0123456789ABCDEFGHIJKLMNOPQRSTUWVXYZ^_`abcdefghijklmnopqrstuvwxyz|~"
+        .split("");
+    for (let i = 0; i <= 255; i++) {
+      const token = String.fromCharCode(i);
+      if (validTokens.includes(token)) {
+        continue;
+      }
+      // ensure there will be an error instead of panic.
+      await assertRejects(() =>
+        fetch("http://localhost:4545/echo_server", {
+          method: "HEAD",
+          headers: { [token]: "value" },
+        }), TypeError);
+    }
+    await assertRejects(() =>
+      fetch("http://localhost:4545/echo_server", {
+        method: "HEAD",
+        headers: { "": "value" },
+      }), TypeError);
+  },
+);