fix: Ensure forbidden CORS headers throw an error (#51)

fixes #40

Author: nzakas

src/cors.js

@@ -72,7 +72,7 @@ const simpleRequestContentTypes = new Set([
 ]);
 
 // the methods that are forbidden to be used with CORS
-const forbiddenMethods = new Set(["CONNECT", "TRACE", "TRACK"]);
+export const forbiddenMethods = new Set(["CONNECT", "TRACE", "TRACK"]);
 
 export const CORS_ALLOW_ORIGIN = "Access-Control-Allow-Origin";
 export const CORS_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials";
@@ -359,6 +359,38 @@ export function isCorsSimpleRequest(request) {
 	return true;
 }
 
+/**
+ * Validates a CORS request.
+ * @param {Request} request The request to validate.
+ * @param {string} origin The origin of the request.
+ * @returns {void}
+ * @throws {CorsError} When the request is not allowed.
+ */
+export function validateCorsRequest(request, origin) {
+	// check the method
+	if (forbiddenMethods.has(request.method)) {
+		throw new CorsError(
+			request.url,
+			origin,
+			`Method ${request.method} is not allowed.`,
+		);
+	}
+
+	// check the headers
+	for (const header of request.headers.keys()) {
+		
+		const value = /** @type {string} */ (request.headers.get(header));
+		
+		if (isForbiddenRequestHeader(header, value)) {
+			throw new CorsError(
+				request.url,
+				origin,
+				`Header ${header} is not allowed.`,
+			);
+		}
+	}
+}
+
 /**
  * A class for storing CORS preflight data.
  */

src/fetch-mocker.js

@@ -13,6 +13,7 @@ import {
 	CorsPreflightData,
 	assertCorsResponse,
 	processCorsResponse,
+	validateCorsRequest,
 	CORS_REQUEST_METHOD,
 	CORS_REQUEST_HEADERS,
 	CORS_ORIGIN,
@@ -228,6 +229,8 @@ export class FetchMocker {
 					useCors = true;
 					const includeCredentials =
 						request.credentials === "include";
+						
+					validateCorsRequest(request, this.#baseUrl.origin);
 
 					if (isCorsSimpleRequest(request)) {
 						if (includeCredentials) {

tests/fetch-mocker.test.js

@@ -10,6 +10,7 @@
 //-----------------------------------------------------------------------------
 
 import assert from "node:assert";
+import { forbiddenMethods, forbiddenRequestHeaders } from "../src/cors.js";
 import { MockServer } from "../src/mock-server.js";
 import { FetchMocker } from "../src/fetch-mocker.js";
 import { CookieCredentials } from "../src/cookie-credentials.js";
@@ -1949,6 +1950,94 @@ describe("FetchMocker", () => {
 				});
 			});
 		});
+		
+		describe("Forbidden headers", () => {
+			
+			[...forbiddenRequestHeaders].forEach(header => {
+				it(`should throw an error when the header is ${header}`, async () => {
+					const server = new MockServer(API_URL);
+					const fetchMocker = new FetchMocker({
+						servers: [server],
+						baseUrl: ALT_BASE_URL,
+					});
+					const url = new URL("/hello", API_URL);
+
+					await assert.rejects(
+						fetchMocker.fetch(url, {
+							headers: {
+								[header]: "Foo",
+							},
+						}),
+						new RegExp(`Header ${header} is not allowed`, "iu"),
+					);
+				});
+			});
+			
+			it("should throw an error when the header begins with sec-", async () => {
+				const server = new MockServer(API_URL);
+				const fetchMocker = new FetchMocker({
+					servers: [server],
+					baseUrl: ALT_BASE_URL,
+				});
+				const url = new URL("/hello", API_URL);
+
+				await assert.rejects(
+					fetchMocker.fetch(url, {
+						headers: {
+							"sec-foo": "Foo",
+						},
+					}),
+					new RegExp("Header sec-foo is not allowed", "iu"),
+				);
+			});
+			
+			it("should throw an error when the header begins with proxy-", async () => {
+				const server = new MockServer(API_URL);
+				const fetchMocker = new FetchMocker({
+					servers: [server],
+					baseUrl: ALT_BASE_URL,
+				});
+				const url = new URL("/hello", API_URL);
+
+				await assert.rejects(
+					fetchMocker.fetch(url, {
+						headers: {
+							"proxy-foo": "Foo",
+						},
+					}),
+					new RegExp("Header proxy-foo is not allowed", "iu"),
+				);
+			});
+			
+			[
+				"X-Http-Method",
+				"X-Http-Method-Override",
+				"X-Method-Override",
+			].forEach(header => {
+				[...forbiddenMethods].forEach(method => {
+					
+					it(`should throw an error when the ${header} header is ${method}`, async () => {
+						const server = new MockServer(API_URL);
+						const fetchMocker = new FetchMocker({
+							servers: [server],
+							baseUrl: ALT_BASE_URL,
+						});
+						const url = new URL("/hello", API_URL);
+
+						await assert.rejects(
+							fetchMocker.fetch(url, {
+								headers: {
+									[header]: method,
+								},
+							}),
+							new RegExp(`Header ${header} is not allowed`, "iu"),
+						);
+					});
+					
+				});
+			});
+			
+		});
 	});
 
 	describe("mockGlobal", () => {