Repository: postmanlabs/postman-code-generators
Pull request #49 (2019-07-10 11:46:05)

Handled proper header sanitisation
Codegens corrected :
- js xhr
- powershell
- libcurl


Patch:
diff --git a/codegens/js-xhr/lib/index.js b/codegens/js-xhr/lib/index.js
index f9499d9..17bcf84 100644
--- a/codegens/js-xhr/lib/index.js
+++ b/codegens/js-xhr/lib/index.js
@@ -103,7 +103,7 @@ function parseHeaders (headers) {
   var headerSnippet = '';
   if (!_.isEmpty(headers)) {
     _.forEach(headers, function (value, key) {
-      headerSnippet += `xhr.setRequestHeader("${key}", "${value}");\n`;
+      headerSnippet += `xhr.setRequestHeader("${sanitize(key)}", "${sanitize(value)}");\n`;
     });
   }
   return headerSnippet;
@@ -195,7 +195,6 @@ function convert (request, options, callback) {
   codeSnippet += headerSnippet + '\n';
 
   codeSnippet += 'xhr.send(data);';
-
   callback(null, codeSnippet);
 }
 
diff --git a/codegens/libcurl/lib/index.js b/codegens/libcurl/lib/index.js
index 3d6cfcd..93eb57e 100644
--- a/codegens/libcurl/lib/index.js
+++ b/codegens/libcurl/lib/index.js
@@ -44,7 +44,7 @@ self = module.exports = {
     snippet += indentString + 'struct curl_slist *headers = NULL;\n';
     headersData = request.getHeaders({ enabled: true });
     _.forEach(headersData, function (value, key) {
-      snippet += indentString + `headers = curl_slist_append(headers, "${key}: ${value}");\n`;
+      snippet += indentString + `headers = curl_slist_append(headers, "${sanitize(key)}: ${sanitize(value)}");\n`;
     });
     body = request.body.toJSON();
     if (body.mode && body.mode === 'formdata' && !options.useMimeType) {
diff --git a/codegens/powershell-restmethod/lib/index.js b/codegens/powershell-restmethod/lib/index.js
index 34e54f1..2259a15 100644
--- a/codegens/powershell-restmethod/lib/index.js
+++ b/codegens/powershell-restmethod/lib/index.js
@@ -123,7 +123,7 @@ function parseHeaders (headers) {
   if (!_.isEmpty(headers)) {
     headerSnippet = '$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"\n';
     _.forEach(headers, function (value, key) {
-      headerSnippet += `$headers.Add("${key}", '${value}')\n`;
+      headerSnippet += `$headers.Add("${sanitize(key)}", "${sanitize(value)}")\n`;
     });
   }
   else {


Test patch:
diff --git a/codegens/js-xhr/test/unit/fixtures/testcollection/collection.json b/codegens/js-xhr/test/unit/fixtures/testcollection/collection.json
index 425cf65..95ad1d1 100644
--- a/codegens/js-xhr/test/unit/fixtures/testcollection/collection.json
+++ b/codegens/js-xhr/test/unit/fixtures/testcollection/collection.json
@@ -63,6 +63,32 @@
 			},
 			"response": []
 		},
+		{
+			"name": "Request headers with double quoted strings in values",
+			"request": {
+				"method": "GET",
+				"header": [
+					{
+						"key": "key",
+						"value": "value\"value",
+						"type": "text"
+					}
+				],
+				"body": {},
+				"url": {
+					"raw": "https://postman-echo.com/get",
+					"protocol": "https",
+					"host": [
+						"postman-echo",
+						"com"
+					],
+					"path": [
+						"get"
+					]
+				}
+			},
+			"response": []
+		},
 		{
 			"name": "GET Request with disabled query",
 			"event": [
diff --git a/codegens/libcurl/test/unit/fixtures/testcollection/collection.json b/codegens/libcurl/test/unit/fixtures/testcollection/collection.json
index 51cc05f..70b321c 100644
--- a/codegens/libcurl/test/unit/fixtures/testcollection/collection.json
+++ b/codegens/libcurl/test/unit/fixtures/testcollection/collection.json
@@ -63,6 +63,32 @@
 			},
 			"response": []
 		},
+		{
+			"name": "Request headers with double quoted strings in values",
+			"request": {
+				"method": "GET",
+				"header": [
+					{
+						"key": "key",
+						"value": "value\"value",
+						"type": "text"
+					}
+				],
+				"body": {},
+				"url": {
+					"raw": "https://postman-echo.com/get",
+					"protocol": "https",
+					"host": [
+						"postman-echo",
+						"com"
+					],
+					"path": [
+						"get"
+					]
+				}
+			},
+			"response": []
+		},
 		{
 			"name": "GET Request with disabled query",
 			"event": [
diff --git a/codegens/powershell-restmethod/test/unit/convert.test.js b/codegens/powershell-restmethod/test/unit/convert.test.js
index cebd162..87bf43a 100644
--- a/codegens/powershell-restmethod/test/unit/convert.test.js
+++ b/codegens/powershell-restmethod/test/unit/convert.test.js
@@ -183,7 +183,7 @@ describe('Powershell-restmethod converter', function () {
         const lines = snippet.split('\n');
         expect(lines[0]).to
           .eql('$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"');
-        expect(lines[1]).to.eql('$headers.Add("Content-Type", \'text/plain\')');
+        expect(lines[1]).to.eql('$headers.Add("Content-Type", "text/plain")');
         expect(lines[3]).to.eql('$body = "Hello world"');
         expect(lines[5]).to.eql('$response = Invoke-RestMethod \'https://mockbin.org/request\' -Method \'POST\' -Headers $headers -Body $body -TimeoutSec 10'); // eslint-disable-line max-len
         expect(lines[6]).to.eql('$response | ConvertTo-Json');
diff --git a/codegens/powershell-restmethod/test/unit/fixtures/testcollection/collection.json b/codegens/powershell-restmethod/test/unit/fixtures/testcollection/collection.json
index 2d30ade..2649659 100644
--- a/codegens/powershell-restmethod/test/unit/fixtures/testcollection/collection.json
+++ b/codegens/powershell-restmethod/test/unit/fixtures/testcollection/collection.json
@@ -63,6 +63,32 @@
 			},
 			"response": []
 		},
+		{
+			"name": "Request headers with single quoted strings in values",
+			"request": {
+				"method": "GET",
+				"header": [
+					{
+						"key": "key",
+						"value": "value'value",
+						"type": "text"
+					}
+				],
+				"body": {},
+				"url": {
+					"raw": "https://postman-echo.com/get",
+					"protocol": "https",
+					"host": [
+						"postman-echo",
+						"com"
+					],
+					"path": [
+						"get"
+					]
+				}
+			},
+			"response": []
+		},
 		{
 			"name": "GET Request with disabled query",
 			"event": [