Skip to content

Commit ba436c6

Browse files
authoredApr 6, 2023
Merge pull request from GHSA-gv7g-x59x-wf8f
* fix: do a case-insensitive comparison when checking header value * changeset * remove export * Update .changeset/happy-pots-move.md
1 parent 23d8327 commit ba436c6

File tree

3 files changed

+9
-3
lines changed

3 files changed

+9
-3
lines changed
 

‎.changeset/happy-pots-move.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
'@sveltejs/kit': patch
3+
---
4+
5+
fix: address security advisory CVE-2023-29008 by doing a case-insensitive comparison when checking header value

‎packages/kit/src/utils/http.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,9 @@ export function negotiate(accept, types) {
5959
* @param {Request} request
6060
* @param {...string} types
6161
*/
62-
export function is_content_type(request, ...types) {
62+
function is_content_type(request, ...types) {
6363
const type = request.headers.get('content-type')?.split(';', 1)[0].trim() ?? '';
64-
return types.includes(type);
64+
return types.includes(type.toLowerCase());
6565
}
6666

6767
/**

‎packages/kit/test/apps/basics/test/server.test.js

+2-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,8 @@ test.describe('CSRF', () => {
6161
const content_types = [
6262
'application/x-www-form-urlencoded',
6363
'multipart/form-data',
64-
'text/plain'
64+
'text/plain',
65+
'text/plaiN'
6566
];
6667
const methods = ['POST', 'PUT', 'PATCH', 'DELETE'];
6768
for (const method of methods) {

0 commit comments

Comments
 (0)
Please sign in to comment.