joyent/node — Issue #2602: node does not sanitize http header field values
Author: alpercelik
Created: 2012-01-24 00:05:42+00:00
State: open

Noticed first with express and submitted a pull request to express framework but after our discussions about the issue with @visionmedia, it seemed more logical to have it in node.

You may find the pull request for express which explains details here
https://github.com/visionmedia/express/pull/974

I did sanitizing in http.js where header field values are stored.
https://github.com/alpercelik/node/commit/667aae596cded9336f50574386683ec39ada43f2