2424const {
2525 MathMin,
2626 Symbol,
27+ Uint8Array,
2728} = primordials ;
2829const { setImmediate } = require ( 'timers' ) ;
2930
@@ -205,7 +206,37 @@ function freeParser(parser, req, socket) {
205206 }
206207}
207208
209+ // Character code ranges for valid HTTP tokens
210+ // Valid chars: ^_`a-zA-Z-0-9!#$%&'*+.|~
208211const tokenRegExp = / ^ [ \^ _ ` a - z A - Z \- 0 - 9 ! # $ % & ' * + . | ~ ] + $ / ;
212+ const validTokenChars = new Uint8Array ( 256 ) ;
213+
214+ // Initialize valid character lookup table
215+ ( function initTokenChars ( ) {
216+ // a-z
217+ for ( let i = 97 ; i <= 122 ; i ++ ) validTokenChars [ i ] = 1 ;
218+ // A-Z
219+ for ( let i = 65 ; i <= 90 ; i ++ ) validTokenChars [ i ] = 1 ;
220+ // 0-9
221+ for ( let i = 48 ; i <= 57 ; i ++ ) validTokenChars [ i ] = 1 ;
222+ // Special chars: !#$%&'*+-.^_`|~
223+ validTokenChars [ 33 ] = 1 ; // !
224+ validTokenChars [ 35 ] = 1 ; // #
225+ validTokenChars [ 36 ] = 1 ; // $
226+ validTokenChars [ 37 ] = 1 ; // %
227+ validTokenChars [ 38 ] = 1 ; // &
228+ validTokenChars [ 39 ] = 1 ; // '
229+ validTokenChars [ 42 ] = 1 ; // *
230+ validTokenChars [ 43 ] = 1 ; // +
231+ validTokenChars [ 45 ] = 1 ; // -
232+ validTokenChars [ 46 ] = 1 ; // .
233+ validTokenChars [ 94 ] = 1 ; // ^
234+ validTokenChars [ 95 ] = 1 ; // _
235+ validTokenChars [ 96 ] = 1 ; // `
236+ validTokenChars [ 124 ] = 1 ; // |
237+ validTokenChars [ 126 ] = 1 ; // ~
238+ } ) ( ) ;
239+
209240/**
210241 * Verifies that the given val is a valid HTTP token
211242 * per the rules defined in RFC 7230
@@ -214,7 +245,19 @@ const tokenRegExp = /^[\^_`a-zA-Z\-0-9!#$%&'*+.|~]+$/;
214245 * @returns {boolean }
215246 */
216247function checkIsHttpToken ( val ) {
217- return tokenRegExp . test ( val ) ;
248+ if ( val . length >= 10 ) {
249+ return tokenRegExp . test ( val ) ;
250+ }
251+
252+ if ( val . length === 0 ) return false ;
253+
254+ // Use lookup table for short strings, regex for longer ones
255+ for ( let i = 0 ; i < val . length ; i ++ ) {
256+ if ( ! validTokenChars [ val . charCodeAt ( i ) ] ) {
257+ return false ;
258+ }
259+ }
260+ return true ;
218261}
219262
220263const headerCharRegex = / [ ^ \t \x20 - \x7e \x80 - \xff ] / ;
0 commit comments