Summary by cubic

Sanitizes multipart headers by stripping CR and LF from Blob.type to prevent header injection in formDataToStream. Adds tests to confirm no injection, correct defaults, and stable Content-Length.

Description

• Strip all CR/LF characters from Content-Type derived from Blob.type.
• Keep valid media types intact; default to application/octet-stream when missing.
• Ensure filenames in Content-Disposition are percent-encoded and safe.
• Synced with v1.x; no functional changes.

Docs

• Add a security note in /docs/ for formDataToStream stating:
  • Blob.type is sanitized to remove CR/LF.
  • Filenames in Content-Disposition are percent-encoded.
  • No API changes; behavior is transparent.

Testing

• Added unit tests for:
  • Blocking CRLF header injection via Blob.type (incl. bare CR or LF).
  • Preserving legitimate Content-Type values.
  • Defaulting to application/octet-stream.
  • Safe filename handling in Content-Disposition.
  • Accurate Content-Length accounting.
• No additional tests needed.

Semantic version impact

Patch release: security bug fix with no API changes.

^{Written for commit 59f848c. Summary will update on new commits.}