@@ -20,6 +20,10 @@ describe("sanitizeMimeType", () => {
2020expect(sanitizeMimeType("text/html; charset=utf-8")).toBe("text/html");
2121expect(sanitizeMimeType("application/json;charset=utf-8")).toBe("application/json");
2222expect(sanitizeMimeType("multipart/form-data; boundary=xxx")).toBe("multipart/form-data");
23+expect(sanitizeMimeType('text/plain; charset="utf-8"')).toBe("text/plain");
24+expect(sanitizeMimeType("text/plain; filename*=utf-8''file%20name.txt")).toBe("text/plain");
25+expect(sanitizeMimeType('text/plain; title="a;b"')).toBe("text/plain");
26+expect(sanitizeMimeType('text/plain; title="a\\\"b"')).toBe("text/plain");
2327});
24282529it("rejects values with trailing junk that is not a parameter", () => {
@@ -32,6 +36,7 @@ describe("sanitizeMimeType", () => {
3236it("rejects an embedded newline before the parameter separator", () => {
3337expect(sanitizeMimeType("image/png\n;charset=utf-8")).toBeUndefined();
3438expect(sanitizeMimeType("image/png \n; charset=utf-8")).toBeUndefined();
39+expect(sanitizeMimeType("image/png; charset=utf-8\n; boundary=xxx")).toBeUndefined();
3540});
36413742it("rejects a bare or whitespace-only parameter section", () => {
@@ -40,6 +45,16 @@ describe("sanitizeMimeType", () => {
4045expect(sanitizeMimeType("image/png;\t")).toBeUndefined();
4146});
424748+it("rejects malformed parameter tails", () => {
49+expect(sanitizeMimeType("image/png; charset")).toBeUndefined();
50+expect(sanitizeMimeType("image/png; charset=utf-8<script>")).toBeUndefined();
51+expect(sanitizeMimeType("image/png; charset=utf-8 garbage")).toBeUndefined();
52+});
53+54+it("rejects non-ASCII values before lowercasing the result", () => {
55+expect(sanitizeMimeType("\u212Amage/png")).toBeUndefined();
56+});
57+4358it("rejects empty, whitespace, or non-string input", () => {
4459expect(sanitizeMimeType("")).toBeUndefined();
4560expect(sanitizeMimeType(" ")).toBeUndefined();
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。