reject content-type headers that have multiple or duplicate types

Author: thehabes

rest.js

@@ -55,6 +55,12 @@ const validateContentType = function (req, res, next) {
             statusMessage: `Missing or empty Content-Type header.`
         }))
     }
+    if (contentType.includes(",")) {
+        return next(createExpressError({
+            statusCode: 415,
+            statusMessage: `Multiple Content-Type values are not allowed. Provide exactly one Content-Type header.`
+        }))
+    }
     if (mimeType === "application/json" || mimeType === "application/ld+json") return next()
     const isSearchEndpoint = req.path === "/search" || req.path.startsWith("/search/")
     if (mimeType === "text/plain" && isSearchEndpoint) return next()

routes/__tests__/contentType.test.js

@@ -173,4 +173,22 @@ describe("Content-Type validation middleware", () => {
         expect(response.text).toContain("Unsupported Content-Type")
     })
 
+    it("returns 415 for comma-separated multiple Content-Type values", async () => {
+        const response = await request(routeTester)
+            .post("/api/create")
+            .set("Content-Type", "application/json, text/plain")
+            .send('{"test":"data"}')
+        expect(response.statusCode).toBe(415)
+        expect(response.text).toContain("Multiple Content-Type values are not allowed")
+    })
+
+    it("returns 415 for valid type smuggled via comma after charset", async () => {
+        const response = await request(routeTester)
+            .post("/api/create")
+            .set("Content-Type", "application/json; charset=utf-8, text/plain")
+            .send('{"test":"data"}')
+        expect(response.statusCode).toBe(415)
+        expect(response.text).toContain("Multiple Content-Type values are not allowed")
+    })
+
 })