node:http2: send array values in raw-form header lists as one field per element

src/js/node/http2.ts

@@ -3752,19 +3752,7 @@
         headers.push(HTTP2_HEADER_DATE, utcDate());
       }
       rawHeadersList = headers;
-      const headersObject = { __proto__: null };
-      for (let i = 0; i < rawHeadersList.length; i += 2) {
-        const key = rawHeadersList[i];
-        const value = rawHeadersList[i + 1];
-        const existing = headersObject[key];
-        if (existing === undefined) headersObject[key] = value;
-        else if ($isArray(existing)) existing.push(value);
-        else headersObject[key] = [existing, value];
-      }
-      if (rawHeadersList[sensitiveHeaders] !== undefined) {
-        headersObject[sensitiveHeaders] = rawHeadersList[sensitiveHeaders];
-      }
-      headers = headersObject;
+      headers = rawHeadersToObject(rawHeadersList, rawHeadersList[sensitiveHeaders]);
     } else if (!$isObject(headers)) {
       throw $ERR_INVALID_ARG_TYPE("headers", "object", headers);
     } else {
@@ -3781,7 +3769,9 @@
     const sensitiveNames = buildSensitiveNames(headers, sensitives);
     // Pre-validate single-value headers in JS so a throwing respond() leaves no partial state in
     // the shared HPACK table (same rule request() applies).
-    if (session[kStrictSingleValueFields] !== false) assertSingleValueHeaders(headers);
+    if (session[kStrictSingleValueFields] !== false) {
+      assertSingleValueHeaders(rawHeadersList !== null ? rawHeadersList : headers);
+    }
     // node keeps the never-index list visible on sentHeaders (symbol keys are not iterated by the
     // wire-encoding path, so re-attaching is safe).
     if (sensitives !== undefined) headers[sensitiveHeaders] = sensitives;
@@ -4019,22 +4009,36 @@
 // node validates header constraints in JS before anything reaches the native encoder, so a
 // throwing request leaves no partial state in the shared HPACK table. Mirror the single-value
 // rule here: duplicated single-value fields (across case variants) and multi-element arrays for
-// them throw before encoding starts.
+// them throw before encoding starts. Accepts the object form or the raw [name, value, ...] list.
 function assertSingleValueHeaders(headers) {
   let seen = null;
+  if ($isArray(headers)) {
+    for (let i = 0; i < headers.length; i += 2) {
+      const name = headers[i];
+      const value = headers[i + 1];
+      // A slot the encoder skips is not an occurrence, wherever it is in the list.
+      if (typeof name !== "string" || value === undefined || ($isArray(value) && value.length === 0)) continue;
+      seen = noteSingleValueField(seen, name, value);
+    }
+    return;
+  }
   const keys = Object.keys(headers);
   for (let i = 0; i < keys.length; i++) {
-    const lower = keys[i].toLowerCase();
-    if (!kSingleValueHeaders.has(lower)) continue;
-    const value = headers[keys[i]];
-    if (($isArray(value) && value.length > 1) || (seen !== null && seen.has(lower))) {
-      throw $ERR_HTTP2_HEADER_SINGLE_VALUE(`Header field "${lower}" must only have a single value`);
-    }
-    if (seen === null) seen = new SafeSet();
-    seen.add(lower);
+    seen = noteSingleValueField(seen, keys[i], headers[keys[i]]);
   }
 }
 
+function noteSingleValueField(seen, name, value) {
+  const lower = name.toLowerCase();
+  if (!kSingleValueHeaders.has(lower)) return seen;
+  if (($isArray(value) && value.length > 1) || (seen !== null && seen.has(lower))) {
+    throw $ERR_HTTP2_HEADER_SINGLE_VALUE(`Header field "${lower}" must only have a single value`);
+  }
+  if (seen === null) seen = new SafeSet();
+  seen.add(lower);
+  return seen;
+}
+
 // Renders a received value the way node's determineSpecificType does for error messages.
 function receivedValueLabel(value) {
   if (value === null) return "null";
@@ -4069,6 +4073,23 @@
   return map;
 }
 
+// Backs sentHeaders for the raw [name, value, ...] form.
+function rawHeadersToObject(rawHeadersList, sensitives) {
+  const headersObject = { __proto__: null };
+  for (let i = 0; i < rawHeadersList.length; i += 2) {
+    const key = rawHeadersList[i];
+    let value = rawHeadersList[i + 1];
+    // The list itself is what gets encoded: a later duplicate must not be pushed into the caller's array.
+    if ($isArray(value)) value = value.slice();
+    const existing = headersObject[key];
+    if (existing === undefined) headersObject[key] = value;
+    else if ($isArray(existing)) existing.push(value);
+    else headersObject[key] = [existing, value];
+  }
+  if (sensitives !== undefined) headersObject[sensitiveHeaders] = sensitives;
+  return headersObject;
+}
+
 function toHeaderObject(headers, sensitiveHeadersValue) {
   const obj = { __proto__: null, [sensitiveHeaders]: sensitiveHeadersValue };
   for (let n = 0; n < headers.length; n += 2) {
@@ -6173,19 +6194,7 @@
           if (path !== undefined) throw $ERR_HTTP2_CONNECT_PATH();
         }
         rawHeadersList = additionalPseudoHeaders.length ? additionalPseudoHeaders.concat(raw) : raw;
-        const headersObject = { __proto__: null };
-        for (let i = 0; i < rawHeadersList.length; i += 2) {
-          const key = rawHeadersList[i];
-          const value = rawHeadersList[i + 1];
-          const existing = headersObject[key];
-          if (existing === undefined) headersObject[key] = value;
-          else if ($isArray(existing)) existing.push(value);
-          else headersObject[key] = [existing, value];
-        }
-        if (raw[sensitiveHeaders] !== undefined) {
-          headersObject[sensitiveHeaders] = raw[sensitiveHeaders];
-        }
-        headers = headersObject;
+        headers = rawHeadersToObject(rawHeadersList, raw[sensitiveHeaders]);
       } else if (!$isObject(headers)) {
         throw $ERR_INVALID_ARG_TYPE("headers", "object", headers);
       } else {
@@ -6243,7 +6252,9 @@
       }
       // Validate single-value constraints before anything is encoded (a mid-encode throw would
       // desync the shared HPACK table from the peer).
-      if (this[kStrictSingleValueFields] !== false) assertSingleValueHeaders(headers);
+      if (this[kStrictSingleValueFields] !== false) {
+        assertSingleValueHeaders(rawHeadersList !== null ? rawHeadersList : headers);
+      }
       // node keeps the never-index list visible on the request's sentHeaders (symbol keys are
       // not iterated by the wire-encoding path, so re-attaching is safe).
       if (sensitives !== undefined) headers[sensitiveHeaders] = sensitives;
@@ -6302,7 +6313,7 @@
       }
 
       let rejectContentLengthOnNoPayload = false;
-      if (NoPayloadMethods.has(method.toUpperCase())) {
+      if (typeof method === "string" && NoPayloadMethods.has(method.toUpperCase())) {
         // Like Node, a payload-meaningless method only defaults endStream to
         // true when the caller expressed no preference; an explicit endStream
         // (validated above) is honored, so { endStream: false } stays open.

src/runtime/api/bun/h2_frame_parser.rs

@@ -8852,7 +8852,8 @@ impl H2FrameParser {
                     }
 
                     let name_str = name_js.to_js_string(global_object)?;
-                    let name_slice = name_str.to_slice(global_object);
+                    // Owned: still used after the values' toString() may have dropped the list's reference to it.
+                    let name_slice = name_str.to_slice_clone(global_object)?;
                     let name = name_slice.slice();
                     if name.is_empty() {
                         continue;
@@ -8895,8 +8896,18 @@ impl H2FrameParser {
                         continue;
                     }
 
+                    let elements = if value_js.js_type().is_array() {
+                        Some(value_js.array_iterator(global_object)?)
+                    } else {
+                        None
+                    };
+                    let field_count = elements.as_ref().map_or(1, |items| items.len);
+                    // node (buildNgHeaderString): [] sends nothing and is not an occurrence.
+                    if field_count == 0 {
+                        continue;
+                    }
                     if let Some(idx) = this.single_value_index_checked(validated_name) {
-                        if single_value_headers[idx] {
+                        if field_count > 1 || single_value_headers[idx] {
                             let exception = global_object.to_type_error(
                                 bun_jsc::ErrorCode::HTTP2_HEADER_SINGLE_VALUE,
                                 format_args!(
@@ -8909,8 +8920,6 @@ impl H2FrameParser {
                         single_value_headers[idx] = true;
                     }
 
-                    let value_str = value_js.to_js_string(global_object)?;
-
                     let never_index = if Self::is_index_like_name(validated_name) {
                         false
                     } else {
@@ -8920,48 +8929,78 @@ impl H2FrameParser {
                         }
                     };
 
-                    let value_slice = value_str.to_slice(global_object);
-                    let value = value_slice.slice();
-                    if !is_valid_header_value(value) {
-                        return Err(global_object
-                            .err(
-                                JscErrorCode::HTTP2_INVALID_HEADER_VALUE,
-                                format_args!(
-                                    "Invalid value for header \"{}\"",
-                                    BStr::new(validated_name)
-                                ),
-                            )
-                            .throw());
-                    }
-                    bun_output::scoped_log!(
-                        H2FrameParser,
-                        "encode header {} {}",
-                        BStr::new(validated_name),
-                        BStr::new(value)
-                    );
-
-                    if let Err(err) = this.encode_header_into_list(
-                        &mut encoded_headers,
-                        validated_name,
-                        value,
-                        never_index,
-                    ) {
-                        if matches!(err, crate::Error::Alloc(_)) {
+                    let mut encode_value = |item: JSValue| -> JsResult<Option<JSValue>> {
+                        let value_str = item.to_js_string(global_object)?;
+                        let value_slice = value_str.to_slice(global_object);
+                        let value = value_slice.slice();
+                        if !is_valid_header_value(value) {
                             return Err(global_object
-                                .throw(format_args!("Failed to allocate header buffer")));
+                                .err(
+                                    JscErrorCode::HTTP2_INVALID_HEADER_VALUE,
+                                    format_args!(
+                                        "Invalid value for header \"{}\"",
+                                        BStr::new(validated_name)
+                                    ),
+                                )
+                                .throw());
                         }
-                        let Some(stream) = this.handle_received_stream_id(stream_id) else {
-                            return Ok(JSValue::js_number(-1.0));
-                        };
-                        // SAFETY: stream is a *mut Stream from self.streams (heap::alloc); valid while the map entry exists
-                        let stream = unsafe { &mut *stream };
-                        if !stream_ctx_arg.is_empty_or_undefined_or_null()
-                            && stream_ctx_arg.is_object()
-                        {
-                            stream.set_context(stream_ctx_arg, global_object);
+                        bun_output::scoped_log!(
+                            H2FrameParser,
+                            "encode header {} {}",
+                            BStr::new(validated_name),
+                            BStr::new(value)
+                        );
+
+                        if let Err(err) = this.encode_header_into_list(
+                            &mut encoded_headers,
+                            validated_name,
+                            value,
+                            never_index,
+                        ) {
+                            if matches!(err, crate::Error::Alloc(_)) {
+                                return Err(global_object
+                                    .throw(format_args!("Failed to allocate header buffer")));
+                            }
+                            let Some(stream) = this.handle_received_stream_id(stream_id) else {
+                                return Ok(Some(JSValue::js_number(-1.0)));
+                            };
+                            // SAFETY: stream is a *mut Stream from self.streams (heap::alloc); valid while the map entry exists
+                            let stream = unsafe { &mut *stream };
+                            if !stream_ctx_arg.is_empty_or_undefined_or_null()
+                                && stream_ctx_arg.is_object()
+                            {
+                                stream.set_context(stream_ctx_arg, global_object);
+                            }
+                            this.schedule_header_compression_session_error();
+                            return Ok(Some(JSValue::js_number(stream_id as f64)));
+                        }
+                        Ok(None)
+                    };
+
+                    match elements {
+                        Some(mut items) => {
+                            while let Some(item) = items.next()? {
+                                if item.is_empty_or_undefined_or_null() {
+                                    return Err(global_object
+                                        .err(
+                                            JscErrorCode::HTTP2_INVALID_HEADER_VALUE,
+                                            format_args!(
+                                                "Invalid value for header \"{}\"",
+                                                BStr::new(validated_name)
+                                            ),
+                                        )
+                                        .throw());
+                                }
+                                if let Some(ret) = encode_value(item)? {
+                                    return Ok(ret);
+                                }
+                            }
+                        }
+                        None => {
+                            if let Some(ret) = encode_value(value_js)? {
+                                return Ok(ret);
+                            }
                         }
-                        this.schedule_header_compression_session_error();
-                        return Ok(JSValue::js_number(stream_id as f64));
                     }
                 }
             }