From 95293ede6eafc10bf297a8f096007467604d7d56 Mon Sep 17 00:00:00 2001 From: Yarchik Date: Tue, 23 Jun 2026 23:33:05 +0100 Subject: [PATCH] fix: trim HTAB as optional whitespace (RFC 7230) RFC 7230 section 3.2.3 defines OWS as *( SP / HTAB ), and list elements are separated by OWS "," OWS. The parse() scanner only handled SP (0x20), so a tab embedded next to an address was left in the token, yielding an invalid address. Handle HTAB (0x09) the same as SP. The existing 'should trim leading OWS' test only exercised SP, so this gap went unnoticed. --- index.js | 1 + test/test.js | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/index.js b/index.js index b2b6bdd..f827135 100644 --- a/index.js +++ b/index.js @@ -65,6 +65,7 @@ function parse (header) { for (var i = header.length - 1; i >= 0; i--) { switch (header.charCodeAt(i)) { case 0x20: /* */ + case 0x09: /* \t */ if (start === end) { start = end = i } diff --git a/test/test.js b/test/test.js index 08e4964..7ac6bb8 100644 --- a/test/test.js +++ b/test/test.js @@ -37,6 +37,13 @@ describe('forwarded(req)', function () { .expect(200, ['127.0.0.1', '10.0.0.1', '10.0.0.2'], done) }) + it('should trim HTAB OWS', function (done) { + request(createServer()) + .get('/') + .set('X-Forwarded-For', '\t10.0.0.2\t,\t10.0.0.1\t') + .expect(200, ['127.0.0.1', '10.0.0.1', '10.0.0.2'], done) + }) + describe('socket address', function () { it('should begin with socket address', function () { var req = createReq('socket', '127.0.0.1')