fix(res.set): remove implicit mime lookup and charset injection for Content-Type #7146
fix(res.set): remove implicit mime lookup and charset injection for Content-Type #7146Pandey-Krishnaa wants to merge 1 commit intoexpressjs:masterfrom
Conversation
…ontent-Type
Previously, res.set('Content-Type', value) silently called mime.contentType()
on the value, which would:
- perform a mime-type lookup if the value contained no '/' (e.g. 'html' → 'text/html; charset=utf-8')
- append a charset if none was present (e.g. 'text/plain' → 'text/plain; charset=utf-8')
This hidden mutation was unexpected: res.set is a generic header setter and
should not transform user input. res.type() already exists as the dedicated
API for mime-lookup + charset behaviour, and callers that want it should use
that method explicitly.
Changes:
- Remove the Content-Type special-case block from res.set/res.header
- res.json now explicitly sets 'application/json; charset=utf-8' so its
behaviour is unchanged without relying on the removed magic
- Update tests to reflect the new pass-through semantics of res.set
Fixes: expressjs#7034
|
Hi, Severity: action required | Category: correctness How to fix: Reject Content-Type array values Agent prompt to fix - you can give this to your LLM of choice:
We noticed a couple of other issues in this PR as well - happy to share if helpful. Spotted by Qodo code review - free for open-source projects. |
2 participants
Closes #7034
res.set('Content-Type', value)was silently callingmime.contentType()on the value, which would:/(e.g.'html'→'text/html; charset=utf-8')'text/plain'→'text/plain; charset=utf-8')This hidden mutation is unexpected —
res.setis a generic header setter and should not transform user input.Solution
Remove the Content-Type special-casing from
res.set/res.header. Users who want mime lookup + charset behaviourshould use
res.type(), which already exists for exactly this purpose.Changes
mime.contentType()block fromres.setres.jsonnow explicitly sets'application/json; charset=utf-8'so its behaviour is unchangedres.setBreaking Change
res.set('Content-Type', 'text/plain')will no longer silently becometext/plain; charset=utf-8. Useres.type('text/plain')if charset injection is desired.