fix: preserve raw:true Buffer headers instead of nulling them (#251)

README.md

@@ -178,7 +178,7 @@ csv({
 
 ##### Parameters
 
-**header** _String_ The current column header.<br/>
+**header** _String | Buffer_ The current column header (a `Buffer` when the `raw` option is `true`).<br/>
 **index** _Number_ The current column index.
 
 #### mapValues
@@ -217,7 +217,7 @@ Specifies a single-character string to denote a quoted string.
 
 Type: `Boolean`<br>
 
-If `true`, instructs the parser not to decode UTF-8 strings.
+If `true`, instructs the parser not to decode UTF-8 strings. This also affects headers: each header (and the `header` passed to `mapHeaders`) is a `Buffer` rather than a `String`. Row keys are still plain strings (JavaScript coerces object keys), but row values remain `Buffer`s.
 
 #### separator
 

index.d.ts

@@ -43,7 +43,7 @@ Bugs Bunny,22
      *   mapHeaders: ({ header, index }) => header.toLowerCase()
      * });
      */
-    readonly mapHeaders?: (args: { header: string; index: number }) => string | null;
+    readonly mapHeaders?: (args: { header: string | Buffer; index: number }) => string | Buffer | null;
 
     /**
      * A function that can be used to modify the value of each column value.

index.js

@@ -20,12 +20,16 @@ const defaults = {
 
 const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
 
-function sanitizeHeader(header) {
-  if (typeof header !== 'string') {
+function sanitizeHeader (header) {
+  let key = header
+
+  if (Buffer.isBuffer(header)) {
+    key = header.toString('utf-8')
+  } else if (typeof header !== 'string') {
     return null
   }
 
-  if (DANGEROUS_KEYS.has(header)) {
+  if (DANGEROUS_KEYS.has(key)) {
     return null
   }
 

index.test-d.ts

@@ -10,13 +10,23 @@ expectType<csvParser.CsvParser>(csvParser({ headers: false }));
 expectType<csvParser.CsvParser>(
   csvParser({
     mapHeaders: ({ header, index }) => {
-      expectType<string>(header);
+      expectType<string | Buffer>(header);
       expectType<number>(index);
-      return header.toLowerCase();
+      return typeof header === 'string' ? header.toLowerCase() : header;
     },
   })
 );
 expectType<csvParser.CsvParser>(csvParser({ mapHeaders: ({ header, index }) => null }));
+expectType<csvParser.CsvParser>(
+  csvParser({
+    raw: true,
+    mapHeaders: ({ header, index }) => {
+      expectType<string | Buffer>(header);
+      expectType<number>(index);
+      return header;
+    },
+  })
+);
 expectType<csvParser.CsvParser>(
   csvParser({
     mapValues: ({ header, index, value }) => {

test/fixtures/prototype-pollution.csv

@@ -0,0 +1,2 @@
+a,__proto__,constructor,prototype,b
+1,2,3,4,5

test/fixtures/raw-headers.csv

@@ -0,0 +1,3 @@
+a,b
+1,2
+3,4

test/issues.test.js

@@ -23,3 +23,44 @@ test.cb('strict + skipLines (#136)', (t) => {
 
   collect('strict+skipLines', { strict: true, skipLines: 1 }, verify)
 })
+
+test.cb('raw headers and rows are preserved (#251)', (t) => {
+  const verify = (err, lines) => {
+    t.false(err, 'no err')
+    t.is(lines.length, 2, '2 rows')
+    t.true(Buffer.isBuffer(lines[0].a), 'header a is a Buffer')
+    t.true(Buffer.isBuffer(lines[0].b), 'header b is a Buffer')
+    t.is(lines[0].a.toString(), '1')
+    t.is(lines[0].b.toString(), '2')
+    t.is(lines[1].a.toString(), '3')
+    t.is(lines[1].b.toString(), '4')
+    t.end()
+  }
+
+  collect('raw-headers', { raw: true }, verify)
+})
+
+test.cb('prototype pollution keys are stripped from headers (#250)', (t) => {
+  const verify = (err, lines) => {
+    t.false(err, 'no err')
+    t.deepEqual(lines[0], { a: '1', b: '5' }, 'dangerous keys stripped')
+    t.false(Object.prototype.hasOwnProperty.call(lines[0], '__proto__'), 'no __proto__ own-property')
+    t.false(Object.prototype.hasOwnProperty.call(lines[0], 'constructor'), 'no constructor own-property')
+    t.false(Object.prototype.hasOwnProperty.call(lines[0], 'prototype'), 'no prototype own-property')
+    t.end()
+  }
+
+  collect('prototype-pollution', verify)
+})
+
+test.cb('prototype pollution keys are stripped from raw Buffer headers (#250 + #251)', (t) => {
+  const verify = (err, lines) => {
+    t.false(err, 'no err')
+    t.is(Object.keys(lines[0]).length, 2, 'only safe headers survive')
+    t.true(Buffer.isBuffer(lines[0].a), 'header a is a Buffer')
+    t.true(Buffer.isBuffer(lines[0].b), 'header b is a Buffer')
+    t.end()
+  }
+
+  collect('prototype-pollution', { raw: true }, verify)
+})