Description

The MIME type validation regex in sanitizeMimeType allows literal CR/LF characters inside quoted-string parameter values.

• HTTP_QUOTED_STRING permits escaped characters via \\[\t -~].
• The character range \t -~ spans ASCII 0x09–0x7E, which includes \n (LF, 0x0A) and \r (CR, 0x0D).
• As a result, an input like text/plain; title="a\\\nInjected: x" can match MIME_TYPE_WITH_OPTIONAL_PARAMS (the newline is part of the quoted-string), causing sanitizeMimeType() to accept a newline-containing header value.

Even though sanitizeMimeType() returns only the type/subtype, callers may incorrectly treat a non-undefined return as a signal that the original MIME string is safe to use in an HTTP header or log line, enabling CRLF/header-injection style issues.

Vulnerable code:

const HTTP_QUOTED_STRING = String.raw`"(?:[\t !#-\[\]-~]|\\[\t -~])*"`;

Recommendation

Reject CR/LF anywhere in the input, including within quoted strings.

Option A (tighten the escape character class): do not use a range starting at \t through space.

For example, only allow HTAB/space or visible ASCII after a backslash:

const QDTEXT = String.raw`[\t !#-\[\]-~]`;        // no CR/LF
const QUOTED_PAIR = String.raw`\\(?:[\t ]|[!-~])`; // no CR/LF
const HTTP_QUOTED_STRING = String.raw`"(?:${QDTEXT}|${QUOTED_PAIR})*"`;

Option B (defense-in-depth): explicitly reject any \r or \n in value before regex matching:

if (/[\r\n]/.test(trimmed)) return undefined;

Add tests to ensure inputs containing \r or \n inside quoted strings are rejected.

Description

sanitizeMimeType attempts to validate and normalize MIME types to an ASCII type/subtype form. However, the validation regex is created with the case-insensitive i flag:

• Character classes like [a-z] under /i perform Unicode case folding in JavaScript.
• This can allow certain non-ASCII code points that case-fold to ASCII letters (e.g., Kelvin sign U+212A → k) to match the ASCII-only pattern.
• The function then returns match[1].toLowerCase(), which can transform the non-ASCII input into an ASCII string, defeating the intent to reject non-ASCII MIME values.

Vulnerable code:

const MIME_TYPE_WITH_OPTIONAL_PARAMS = new RegExp(
  String.raw`^${MIME_TYPE}(?:${MIME_PARAMETER})*$`,
  "i",
);
...
const match = trimmed.match(MIME_TYPE_WITH_OPTIONAL_PARAMS);
return match?.[1]?.toLowerCase();

Impact depends on downstream usage (e.g., allowlists/branching logic based on the sanitized MIME type): a crafted non-ASCII value can pass sanitization and be normalized to an ASCII token that may be treated as trusted.

Recommendation

Avoid Unicode case-folding during validation and explicitly enforce ASCII:

1. Remove the i flag and validate against a lowercased ASCII-only input.
2. Reject any non-ASCII characters before lowercasing.

Example fix:

const ASCII_ONLY = /^[\x00-\x7F]+$/;

export function sanitizeMimeType(value?: string): string | undefined {
  const trimmed = normalizeOptionalString(value);
  if (!trimmed || !ASCII_ONLY.test(trimmed)) return undefined;

  const lower = trimmed.toLowerCase();
  const match = lower.match(MIME_TYPE_WITH_OPTIONAL_PARAMS_CASE_SENSITIVE);
  return match?.[1];
}

const MIME_TYPE_WITH_OPTIONAL_PARAMS_CASE_SENSITIVE = new RegExp(
  String.raw`^${MIME_TYPE}(?:${MIME_PARAMETER})*$`
);

This ensures only ASCII input is accepted and prevents Unicode confusable/case-folding bypasses.