fix(mitm): clean invalid response characters

Author: blakebyrnes

mitm/handlers/HeadersHandler.ts

@@ -96,9 +96,10 @@ export default class HeadersHandler {
         if (singleValueHttp2Headers.has(lowerHeaderName)) {
           headers[canonizedKey] = value[0];
         } else {
-          headers[canonizedKey] = [...value];
+          headers[canonizedKey] = [...value].filter(x => !checkInvalidHeaderChar(x));
         }
       } else {
+        if (checkInvalidHeaderChar(value)) continue;
         headers[canonizedKey] = value;
       }
     }
@@ -206,6 +207,17 @@ export default class HeadersHandler {
   }
 }
 
+const headerCharRegex = /[^\t\x20-\x7e\x80-\xff]/;
+/**
+ * True if val contains an invalid field-vchar
+ *  field-value    = *( field-content / obs-fold )
+ *  field-content  = field-vchar [ 1*( SP / HTAB ) field-vchar ]
+ *  field-vchar    = VCHAR / obs-text
+ */
+function checkInvalidHeaderChar(val): boolean {
+  return headerCharRegex.test(val);
+}
+
 const lowerCaseMap = new Map<string, string>();
 
 function toLowerCase(header: string): string {

mitm/handlers/HttpRequestHandler.ts

@@ -202,12 +202,21 @@ export default class HttpRequestHandler extends BaseHttpHandler {
 
   private writeResponseHead(): void {
     const context = this.context;
-    const { serverToProxyResponse, proxyToClientResponse } = context;
+    const { serverToProxyResponse, proxyToClientResponse, requestSession } = context;
 
     proxyToClientResponse.statusCode = context.status;
     // write individually so we properly write header-lists
     for (const [key, value] of Object.entries(context.responseHeaders)) {
-      proxyToClientResponse.setHeader(key, value);
+      try {
+        proxyToClientResponse.setHeader(key, value);
+      } catch (error) {
+        log.info(`MitmHttpRequest.writeResponseHeadError`, {
+          sessionId: requestSession.sessionId,
+          request: `${context.method}: ${context.url.href}`,
+          error,
+          header: [key, value],
+        });
+      }
     }
 
     serverToProxyResponse.once('trailers', headers => {