@zudojs/http 0.1.0 → 1.0.0

package/dist/httpBody/http.body.js

@@ -1,7 +1,14 @@
+import { HTTP_DEFAULTS } from "../httpConstants/http.constants.js";
 /* -------------------------------------------------------------------------- */
 /* Defaults                                                                   */
 /* -------------------------------------------------------------------------- */
-export const DEFAULT_BODY_LIMIT = 1_048_576;
+/**
+ * The package-wide default body limit.
+ *
+ * Aliases `HTTP_DEFAULTS.BODY_LIMIT` rather than repeating the literal, so
+ * the two cannot drift apart.
+ */
+export const DEFAULT_BODY_LIMIT = HTTP_DEFAULTS.BODY_LIMIT;
 export const DEFAULT_BODY_ENCODING = "utf8";
 /* -------------------------------------------------------------------------- */
 /* Content Types                                                              */
@@ -60,6 +67,15 @@ export async function readBody(options) {
             if (settled) {
                 return;
             }
+            /*
+             * A body shorter than its declared Content-Length means the client
+             * stopped sending. Resolving it hands a silently truncated request to
+             * the caller as if it had arrived complete.
+             */
+            if (contentLength !== undefined && total !== contentLength) {
+                fail(new HTTPBodyParseError("Request body length does not match Content-Length."));
+                return;
+            }
             settled = true;
             cleanup();
             resolve(Buffer.concat(chunks, total));
@@ -92,19 +108,32 @@ export async function readText(options) {
 /* -------------------------------------------------------------------------- */
 /* JSON Parsing                                                               */
 /* -------------------------------------------------------------------------- */
-export async function readJSON(options = {
-    request: undefined,
-}) {
+/**
+ * Reads and parses a JSON request body.
+ *
+ * With `strict: true` an empty body is rejected and the top-level value must
+ * be an object or an array — a bare scalar such as `5`, `null` or `"x"` is
+ * not accepted as a request body.
+ */
+export async function readJSON(options) {
     const text = await readText(options);
     if (text.trim() === "") {
+        if (options.strict) {
+            throw new HTTPBodyParseError("Request body is empty.");
+        }
         return undefined;
     }
+    let parsed;
     try {
-        return JSON.parse(text);
+        parsed = JSON.parse(text);
     }
     catch (error) {
         throw new HTTPBodyParseError("Invalid JSON request body.", error);
     }
+    if (options.strict && (parsed === null || typeof parsed !== "object")) {
+        throw new HTTPBodyParseError("JSON request body must be an object or an array.");
+    }
+    return parsed;
 }
 /* -------------------------------------------------------------------------- */
 /* Form URL Encoded                                                           */
@@ -112,9 +141,15 @@ export async function readJSON(options = {
 export async function readForm(options) {
     const text = await readText(options);
     const params = new URLSearchParams(text);
-    const result = {};
+    /*
+     * A null-prototype container: a field named `__proto__` can neither replace
+     * the returned object's prototype nor be read back as an inherited member.
+     */
+    const result = Object.create(null);
     for (const [key, value] of params.entries()) {
-        const existing = result[key];
+        const existing = Object.prototype.hasOwnProperty.call(result, key)
+            ? result[key]
+            : undefined;
         if (existing === undefined) {
             result[key] = value;
             continue;
@@ -160,21 +195,21 @@ export function isJSONContentType(contentType) {
     if (!contentType) {
         return false;
     }
-    const normalized = contentType.split(";", 1)[0].trim().toLowerCase();
+    const normalized = (contentType.split(";", 1)[0] ?? "").trim().toLowerCase();
     return normalized === BODY_CONTENT_TYPES.JSON || normalized.endsWith("+json");
 }
 export function isFormContentType(contentType) {
     if (!contentType) {
         return false;
     }
-    return (contentType.split(";", 1)[0].trim().toLowerCase() ===
+    return ((contentType.split(";", 1)[0] ?? "").trim().toLowerCase() ===
         BODY_CONTENT_TYPES.FORM_URLENCODED);
 }
 export function isTextContentType(contentType) {
     if (!contentType) {
         return false;
     }
-    const normalized = contentType.split(";", 1)[0].trim().toLowerCase();
+    const normalized = (contentType.split(";", 1)[0] ?? "").trim().toLowerCase();
     return (normalized.startsWith("text/") || normalized === BODY_CONTENT_TYPES.HTML);
 }
 export function isMultipartContentType(contentType) {
@@ -189,23 +224,48 @@ export function isMultipartContentType(contentType) {
 /* -------------------------------------------------------------------------- */
 /* Content Length                                                             */
 /* -------------------------------------------------------------------------- */
+/**
+ * Reads `Content-Length`.
+ *
+ * RFC 9112 §6.1 requires a recipient to reject a message that carries both
+ * `Content-Length` and `Transfer-Encoding`, and §6.3 to reject conflicting
+ * `Content-Length` values. Taking the first of a duplicated pair and ignoring
+ * the rest — as this did — is the attacker-favourable half of a CL.TE/CL.CL
+ * request-smuggling differential whenever the message reaches this helper
+ * from something other than Node's own HTTP/1 parser.
+ */
 export function getContentLength(request) {
-    const value = request.headers["content-length"];
-    if (Array.isArray(value)) {
-        return parseContentLength(value[0]);
+    const header = request.headers["content-length"];
+    if (header === undefined) {
+        return undefined;
     }
-    if (typeof value !== "string") {
+    const values = (Array.isArray(header) ? header : [header]).flatMap((entry) => typeof entry === "string" ? entry.split(",") : []);
+    if (values.length === 0) {
         return undefined;
     }
-    return parseContentLength(value);
+    let length;
+    for (const value of values) {
+        const parsed = parseContentLength(value.trim());
+        if (parsed === undefined) {
+            throw new HTTPBodyParseError("Invalid Content-Length header.");
+        }
+        if (length !== undefined && parsed !== length) {
+            throw new HTTPBodyParseError("Conflicting Content-Length headers.");
+        }
+        length = parsed;
+    }
+    if (request.headers["transfer-encoding"] !== undefined) {
+        throw new HTTPBodyParseError("Content-Length and Transfer-Encoding must not both be present.");
+    }
+    return length;
 }
 function parseContentLength(value) {
-    if (!value) {
+    if (!/^\d+$/.test(value)) {
         return undefined;
     }
     const parsed = Number(value);
     if (!Number.isSafeInteger(parsed) || parsed < 0) {
-        throw new HTTPBodyParseError("Invalid Content-Length header.");
+        return undefined;
     }
     return parsed;
 }

package/dist/httpBody/httpBody.formData.d.ts

@@ -40,7 +40,22 @@ export declare const DEFAULT_MAX_FILES = 100;
 export declare function isMultipartContentType(contentType: string | undefined): boolean;
 export declare function getMultipartBoundary(contentType: string | undefined): string | undefined;
 export declare function parseFormData(options: HTTPFormDataParseOptions): Promise<HTTPFormData>;
+/**
+ * Parses a multipart body into an {@link HTTPFormData}.
+ *
+ * The parsing itself is delegated to `httpMultipart`, which is the package's
+ * single multipart engine. This function only applies the form-data limits
+ * and shapes the result. Routing both entry points through one parser is what
+ * guarantees two components in the same application cannot see different
+ * field names, different filenames or different bytes for the same request.
+ */
 export declare function parseMultipartBody(body: Buffer, boundary: string, options: Omit<HTTPFormDataParseOptions, "request" | "limit">): HTTPFormData;
+/**
+ * Reduces an uploaded filename to a safe basename.
+ *
+ * Delegates to the single implementation in `httpMultipart` so the three
+ * copies that used to exist cannot drift apart.
+ */
 export declare function sanitizeFilename(filename: string): string;
 import { HttpFormDataError as HTTPFormDataError, HttpFormDataLimitError as HTTPFormDataLimitError, HttpFormDataParseError as HTTPFormDataParseError } from "@zudojs/errors";
 export { HTTPFormDataError, HTTPFormDataLimitError, HTTPFormDataParseError };

package/dist/httpBody/httpBody.formData.js

@@ -1,4 +1,5 @@
 import { readBody } from "./http.body.js";
+import { parseMultipartParts, sanitizeFilename as sanitizeMultipartFilename, } from "../httpMultipart/http.multipart.js";
 /* -------------------------------------------------------------------------- */
 /* Defaults                                                                   */
 /* -------------------------------------------------------------------------- */
@@ -82,87 +83,54 @@ export async function parseFormData(options) {
 /* -------------------------------------------------------------------------- */
 /* Multipart Parser                                                           */
 /* -------------------------------------------------------------------------- */
+/**
+ * Parses a multipart body into an {@link HTTPFormData}.
+ *
+ * The parsing itself is delegated to `httpMultipart`, which is the package's
+ * single multipart engine. This function only applies the form-data limits
+ * and shapes the result. Routing both entry points through one parser is what
+ * guarantees two components in the same application cannot see different
+ * field names, different filenames or different bytes for the same request.
+ */
 export function parseMultipartBody(body, boundary, options) {
     const { maxFields = DEFAULT_MAX_FIELDS, maxFieldSize = DEFAULT_MAX_FIELD_SIZE, maxFileSize = DEFAULT_MAX_FILE_SIZE, maxFiles = DEFAULT_MAX_FILES, strict = true, } = options;
-    const boundaryBuffer = Buffer.from(`--${boundary}`, "utf8");
+    const multipartOptions = {
+        maxFields,
+        maxFieldSize,
+        maxFileSize,
+        maxFiles,
+        maxParts: maxFields + maxFiles,
+        allowUnnamedParts: !strict,
+    };
     const result = new HTTPFormDataImpl();
-    let position = 0;
     let fieldCount = 0;
     let fileCount = 0;
-    if (!body.subarray(0, boundaryBuffer.length).equals(boundaryBuffer)) {
-        throw new HTTPFormDataParseError("Invalid multipart body.");
-    }
-    position = boundaryBuffer.length;
-    while (position < body.length) {
-        if (body[position] === 45 && body[position + 1] === 45) {
-            break;
-        }
-        if (body[position] === 13 && body[position + 1] === 10) {
-            position += 2;
-        }
-        else if (strict) {
-            throw new HTTPFormDataParseError("Invalid multipart boundary separator.");
-        }
-        const nextBoundary = findBoundary(body, boundaryBuffer, position);
-        if (nextBoundary === -1) {
-            throw new HTTPFormDataParseError("Multipart closing boundary was not found.");
-        }
-        const partEnd = nextBoundary;
-        const headerEnd = findHeaderEnd(body, position, partEnd);
-        if (headerEnd === -1) {
-            throw new HTTPFormDataParseError("Multipart part headers are invalid.");
-        }
-        const headerBuffer = body.subarray(position, headerEnd);
-        const headers = parsePartHeaders(headerBuffer);
-        const disposition = headers.get("content-disposition");
-        if (!disposition) {
-            if (strict) {
-                throw new HTTPFormDataParseError("Multipart part is missing Content-Disposition.");
-            }
-            position = nextBoundary + boundaryBuffer.length;
-            continue;
-        }
-        const metadata = parseContentDisposition(disposition);
-        if (!metadata.name) {
-            if (strict) {
-                throw new HTTPFormDataParseError("Multipart part is missing a field name.");
-            }
-            position = nextBoundary + boundaryBuffer.length;
-            continue;
-        }
-        const dataStart = headerEnd + 4;
-        const dataEnd = partEnd;
-        const data = body.subarray(dataStart, dataEnd);
-        if (metadata.filename !== undefined) {
+    for (const part of parseMultipartParts(body, boundary, multipartOptions)) {
+        if (part.filename !== undefined) {
             fileCount += 1;
             if (fileCount > maxFiles) {
                 throw new HTTPFormDataLimitError("Maximum file count exceeded.");
             }
-            if (data.length > maxFileSize) {
+            if (part.data.length > maxFileSize) {
                 throw new HTTPFormDataLimitError("Multipart file exceeds the configured size limit.");
             }
-            const filename = sanitizeFilename(metadata.filename);
-            const contentType = headers.get("content-type") ?? "application/octet-stream";
-            result.append(metadata.name, {
-                fieldName: metadata.name,
-                filename,
-                contentType,
-                size: data.length,
-                data: Buffer.from(data),
+            result.append(part.name, {
+                fieldName: part.name,
+                filename: sanitizeFilename(part.filename),
+                contentType: part.contentType ?? "application/octet-stream",
+                size: part.data.length,
+                data: Buffer.from(part.data),
             });
+            continue;
         }
-        else {
-            fieldCount += 1;
-            if (fieldCount > maxFields) {
-                throw new HTTPFormDataLimitError("Maximum field count exceeded.");
-            }
-            if (data.length > maxFieldSize) {
-                throw new HTTPFormDataLimitError("Multipart field exceeds the configured size limit.");
-            }
-            const charset = getCharset(headers.get("content-type"));
-            result.append(metadata.name, data.toString(charset));
+        fieldCount += 1;
+        if (fieldCount > maxFields) {
+            throw new HTTPFormDataLimitError("Maximum field count exceeded.");
+        }
+        if (part.data.length > maxFieldSize) {
+            throw new HTTPFormDataLimitError("Multipart field exceeds the configured size limit.");
         }
-        position = nextBoundary + boundaryBuffer.length;
+        result.append(part.name, decodePartText(part.data, part.contentType));
     }
     return result;
 }
@@ -205,7 +173,8 @@ class HTTPFormDataImpl {
     toObject() {
         const result = {};
         for (const [name, values] of this.data) {
-            result[name] = values.length === 1 ? values[0] : [...values];
+            const single = values.length === 1 ? values[0] : undefined;
+            result[name] = single === undefined ? [...values] : single;
         }
         return result;
     }
@@ -238,111 +207,54 @@ class HTTPFormDataImpl {
     }
 }
 /* -------------------------------------------------------------------------- */
-/* Headers                                                                    */
-/* -------------------------------------------------------------------------- */
-function parsePartHeaders(input) {
-    const text = input.toString("latin1");
-    const result = new Map();
-    for (const line of text.split("\r\n")) {
-        const separator = line.indexOf(":");
-        if (separator <= 0) {
-            continue;
-        }
-        const name = line.slice(0, separator).trim().toLowerCase();
-        const value = line.slice(separator + 1).trim();
-        result.set(name, value);
-    }
-    return result;
-}
-function parseContentDisposition(value) {
-    const parts = value.split(";");
-    if (parts[0]?.trim().toLowerCase() !== "form-data") {
-        return {
-            name: undefined,
-            filename: undefined,
-        };
-    }
-    let name;
-    let filename;
-    for (const part of parts.slice(1)) {
-        const separator = part.indexOf("=");
-        if (separator === -1) {
-            continue;
-        }
-        const key = part.slice(0, separator).trim().toLowerCase();
-        let parameter = part.slice(separator + 1).trim();
-        if (parameter.length >= 2 &&
-            parameter.startsWith('"') &&
-            parameter.endsWith('"')) {
-            parameter = parameter.slice(1, -1);
-        }
-        parameter = parameter.replace(/\\"/g, '"');
-        if (key === "name") {
-            name = parameter;
-        }
-        if (key === "filename") {
-            filename = parameter;
-        }
-    }
-    return {
-        name,
-        filename,
-    };
-}
-/* -------------------------------------------------------------------------- */
-/* Multipart Search                                                           */
-/* -------------------------------------------------------------------------- */
-function findBoundary(body, boundary, start) {
-    for (let index = start; index <= body.length - boundary.length; index += 1) {
-        if (body[index] !== 13 || body[index + 1] !== 10) {
-            continue;
-        }
-        if (body.subarray(index + 2, index + 2 + boundary.length).equals(boundary)) {
-            return index;
-        }
-    }
-    return -1;
-}
-function findHeaderEnd(body, start, end) {
-    for (let index = start; index + 3 < end; index += 1) {
-        if (body[index] === 13 &&
-            body[index + 1] === 10 &&
-            body[index + 2] === 13 &&
-            body[index + 3] === 10) {
-            return index;
-        }
-    }
-    return -1;
-}
-/* -------------------------------------------------------------------------- */
 /* Filename Security                                                          */
 /* -------------------------------------------------------------------------- */
+/**
+ * Reduces an uploaded filename to a safe basename.
+ *
+ * Delegates to the single implementation in `httpMultipart` so the three
+ * copies that used to exist cannot drift apart.
+ */
 export function sanitizeFilename(filename) {
-    const normalized = filename.replace(/\\/g, "/").split("/").pop() ?? "";
-    return normalized.replace(/[\x00-\x1f\x7f]/g, "").trim();
+    return sanitizeMultipartFilename(filename);
 }
 /* -------------------------------------------------------------------------- */
 /* Charset                                                                    */
 /* -------------------------------------------------------------------------- */
+/**
+ * Decodes a field's bytes using the charset the part declared.
+ *
+ * `TextDecoder` covers the whole WHATWG encoding set, so `utf-16le`,
+ * `shift_jis` and the rest decode correctly instead of being silently
+ * mangled into UTF-8 replacement characters. A charset no decoder recognises
+ * is reported rather than swallowed.
+ */
+function decodePartText(data, contentType) {
+    const charset = getCharset(contentType);
+    if (charset === undefined) {
+        return data.toString("utf8");
+    }
+    try {
+        return new TextDecoder(charset).decode(data);
+    }
+    catch {
+        throw new HTTPFormDataParseError("Multipart part declares an unsupported charset.");
+    }
+}
+/**
+ * Reads the `charset` parameter of a media type.
+ *
+ * The parameter name is anchored to a parameter boundary so a `charset=`
+ * substring inside another parameter's quoted value cannot be mistaken for
+ * the real one.
+ */
 function getCharset(contentType) {
     if (!contentType) {
-        return "utf8";
-    }
-    const match = /charset\s*=\s*"?([^;"\s]+)"?/i.exec(contentType);
-    if (!match?.[1]) {
-        return "utf8";
-    }
-    const charset = match[1].toLowerCase();
-    if (charset === "utf-8" || charset === "utf8") {
-        return "utf8";
-    }
-    if (charset === "ascii") {
-        return "ascii";
-    }
-    if (charset === "latin1" || charset === "iso-8859-1") {
-        return "latin1";
+        return undefined;
     }
-    return "utf8";
+    const match = /(?:^|;)\s*charset\s*=\s*(?:"([^"]*)"|([^;"\s]+))/i.exec(contentType);
+    const charset = (match?.[1] ?? match?.[2])?.trim().toLowerCase();
+    return charset && charset.length > 0 ? charset : undefined;
 }
 /* -------------------------------------------------------------------------- */
 /* Validation                                                                 */

package/dist/httpBody/httpBody.parser.d.ts

@@ -25,8 +25,20 @@ export declare function parseTextBody(request: IncomingMessage, options?: BodyPa
 export declare function parseRawBody(request: IncomingMessage, options?: BodyParserOptions): Promise<Buffer>;
 export declare function parseMultipartBody(request: IncomingMessage, options?: BodyParserOptions): Promise<MultipartForm>;
 export declare function createBodyParser(options?: BodyParserOptions): BodyParser;
+/**
+ * Reports whether a request is framed as carrying a body.
+ *
+ * A message carrying both `Content-Length` and `Transfer-Encoding` is
+ * rejected rather than being resolved in favour of either framing — RFC 9112
+ * §6.1 requires that, and silently picking one is the CL.TE half of a
+ * request-smuggling differential.
+ */
 export declare function hasRequestBody(request: IncomingMessage): boolean;
 export declare function getRequestContentType(request: IncomingMessage): string | undefined;
+/**
+ * Reads `Content-Length`, rejecting duplicate headers whose values disagree
+ * and a message that also carries `Transfer-Encoding`.
+ */
 export declare function getRequestContentLength(request: IncomingMessage): number | undefined;
 export declare function isJSONRequest(request: IncomingMessage): boolean;
 export declare function isFormRequest(request: IncomingMessage): boolean;

package/dist/httpBody/httpBody.parser.js

@@ -15,8 +15,14 @@ export async function parseRequestBody(request, options = {}) {
     const contentType = getRequestContentType(request);
     const contentLength = getRequestContentLength(request);
     const format = detectBodyFormat(contentType);
-    if (options.strictContentType && format === "raw" && contentType) {
-        throw new UnsupportedBodyTypeError(contentType);
+    /*
+     * `strictContentType` means "only accept media types this parser
+     * understands". Omitting the header is easier than supplying an
+     * unrecognised one, so a missing Content-Type must be rejected too or the
+     * option only blocks the harmless case.
+     */
+    if (options.strictContentType && format === "raw") {
+        throw new UnsupportedBodyTypeError(contentType ?? "(missing)");
     }
     const body = await parseByFormat(request, format, options);
     return {
@@ -61,7 +67,6 @@ async function parseByFormat(request, format, options) {
                 request,
                 limit: options.limit ?? DEFAULT_BODY_LIMIT,
                 encoding: options.encoding ?? DEFAULT_BODY_ENCODING,
-                strict: options.strict,
             });
         case "multipart":
             return parseMultipart(request, {
@@ -69,6 +74,8 @@ async function parseByFormat(request, format, options) {
                 maxFileSize: options.multipart?.maxFileSize,
                 maxFiles: options.multipart?.maxFiles,
                 maxFields: options.multipart?.maxFields,
+                maxFieldSize: options.multipart?.maxFieldSize,
+                maxParts: options.multipart?.maxParts,
                 encoding: options.multipart?.encoding ??
                     options.encoding ??
                     DEFAULT_BODY_ENCODING,
@@ -78,7 +85,6 @@ async function parseByFormat(request, format, options) {
                 request,
                 limit: options.limit ?? DEFAULT_BODY_LIMIT,
                 encoding: options.encoding ?? DEFAULT_BODY_ENCODING,
-                strict: options.strict,
             });
         case "raw":
         default:
@@ -86,7 +92,6 @@ async function parseByFormat(request, format, options) {
                 request,
                 limit: options.limit ?? DEFAULT_BODY_LIMIT,
                 encoding: options.encoding ?? DEFAULT_BODY_ENCODING,
-                strict: options.strict,
             });
     }
 }
@@ -106,7 +111,6 @@ export async function parseFormBody(request, options = {}) {
         request,
         limit: options.limit ?? DEFAULT_BODY_LIMIT,
         encoding: options.encoding ?? DEFAULT_BODY_ENCODING,
-        strict: options.strict,
     });
 }
 export async function parseTextBody(request, options = {}) {
@@ -114,7 +118,6 @@ export async function parseTextBody(request, options = {}) {
         request,
         limit: options.limit ?? DEFAULT_BODY_LIMIT,
         encoding: options.encoding ?? DEFAULT_BODY_ENCODING,
-        strict: options.strict,
     });
 }
 export async function parseRawBody(request, options = {}) {
@@ -122,7 +125,6 @@ export async function parseRawBody(request, options = {}) {
         request,
         limit: options.limit ?? DEFAULT_BODY_LIMIT,
         encoding: options.encoding ?? DEFAULT_BODY_ENCODING,
-        strict: options.strict,
     });
 }
 export async function parseMultipartBody(request, options = {}) {
@@ -131,6 +133,8 @@ export async function parseMultipartBody(request, options = {}) {
         maxFileSize: options.multipart?.maxFileSize,
         maxFiles: options.multipart?.maxFiles,
         maxFields: options.multipart?.maxFields,
+        maxFieldSize: options.multipart?.maxFieldSize,
+        maxParts: options.multipart?.maxParts,
         encoding: options.multipart?.encoding ?? options.encoding ?? DEFAULT_BODY_ENCODING,
     });
 }
@@ -151,6 +155,14 @@ export function createBodyParser(options = {}) {
 /* -------------------------------------------------------------------------- */
 /* Request Inspection                                                         */
 /* -------------------------------------------------------------------------- */
+/**
+ * Reports whether a request is framed as carrying a body.
+ *
+ * A message carrying both `Content-Length` and `Transfer-Encoding` is
+ * rejected rather than being resolved in favour of either framing — RFC 9112
+ * §6.1 requires that, and silently picking one is the CL.TE half of a
+ * request-smuggling differential.
+ */
 export function hasRequestBody(request) {
     const method = request.method?.toUpperCase();
     if (method === "GET" || method === "HEAD" || method === "OPTIONS") {
@@ -182,15 +194,33 @@ export function getRequestContentType(request) {
 /* -------------------------------------------------------------------------- */
 /* Content Length                                                             */
 /* -------------------------------------------------------------------------- */
+/**
+ * Reads `Content-Length`, rejecting duplicate headers whose values disagree
+ * and a message that also carries `Transfer-Encoding`.
+ */
 export function getRequestContentLength(request) {
-    const value = request.headers["content-length"];
-    const raw = Array.isArray(value) ? value[0] : value;
-    if (typeof raw !== "string") {
+    const header = request.headers["content-length"];
+    if (header === undefined) {
+        return undefined;
+    }
+    const values = (Array.isArray(header) ? header : [header]).flatMap((entry) => typeof entry === "string" ? entry.split(",") : []);
+    if (values.length === 0) {
         return undefined;
     }
-    const length = Number(raw);
-    if (!Number.isSafeInteger(length) || length < 0) {
-        throw new InvalidContentLengthError(raw);
+    let length;
+    for (const value of values) {
+        const raw = value.trim();
+        const parsed = Number(raw);
+        if (!/^\d+$/.test(raw) || !Number.isSafeInteger(parsed)) {
+            throw new InvalidContentLengthError(raw);
+        }
+        if (length !== undefined && parsed !== length) {
+            throw new InvalidContentLengthError(values.join(", "));
+        }
+        length = parsed;
+    }
+    if (request.headers["transfer-encoding"] !== undefined) {
+        throw new InvalidContentLengthError("Content-Length and Transfer-Encoding must not both be present.");
     }
     return length;
 }

package/dist/httpCacheControl/core/httpCacheControl.parse.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Cache control header parsing and formatting.
+ *
+ * @module httpCacheControl/parsing
+ */
+import type { CacheControlDirectives, CacheControlOptions } from "./httpCacheControl.type.js";
+/**
+ * Parses a Cache-Control header value into directives.
+ *
+ * The comma split honours `quoted-string`, so the qualified form
+ * `no-cache="Set-Cookie, Authorization"` survives instead of being torn into
+ * an unqualified `no-cache` — which would let a shared cache store and replay
+ * a response's `Set-Cookie` and `Authorization` headers to other users.
+ *
+ * A directive that appears more than once with conflicting values is dropped
+ * entirely, per RFC 9111 section 4.2.1; taking the last value is the
+ * attacker-favourable choice.
+ *
+ * @param header - The raw header value.
+ * @returns The parsed directives.
+ */
+export declare function parseCacheControl(header: string | undefined): CacheControlDirectives;
+/**
+ * Formats CacheControlDirectives into a Cache-Control header string.
+ */
+export declare function formatCacheControl(directives: CacheControlOptions): string;
+//# sourceMappingURL=httpCacheControl.parse.d.ts.map