deps: update undici to 7.29.0

PR-URL: #64713
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

Author: nodejs-github-bot

deps/undici/src/lib/cache/memory-cache-store.js

@@ -218,17 +218,62 @@ class MemoryCacheStore extends EventEmitter {
 }
 
 functionfindEntry(key,entries,now){
-returnentries.find((entry)=>(
-entry.deleteAt>now&&
-entry.method===key.method&&
-(entry.vary==null||Object.keys(entry.vary).every(headerName=>{
-if(entry.vary[headerName]===null){
-returnkey.headers[headerName]===undefined
+for(leti=0;i<entries.length;i++){
+constentry=entries[i]
+if(
+entry.deleteAt>now&&
+entry.method===key.method&&
+varyMatches(key,entry)
+){
+returnentry
+}
+}
+}
+
+functionvaryMatches(key,entry){
+if(entry.vary==null){
+returntrue
+}
+
+for(constheaderNameinentry.vary){
+if(Object.hasOwn(entry.vary,headerName)&&!headerValueEquals(key.headers?.[headerName],entry.vary[headerName])){
+returnfalse
+}
+}
+
+returntrue
+}
+
+/**
+ * @param {string|string[]|null|undefined} lhs
+ * @param {string|string[]|null|undefined} rhs
+ * @returns {boolean}
+ */
+functionheaderValueEquals(lhs,rhs){
+if(lhs==null&&rhs==null){
+returntrue
+}
+
+if((lhs==null&&rhs!=null)||
+(lhs!=null&&rhs==null)){
+returnfalse
+}
+
+if(Array.isArray(lhs)&&Array.isArray(rhs)){
+if(lhs.length!==rhs.length){
+returnfalse
+}
+
+for(leti=0;i<lhs.length;i++){
+if(lhs[i]!==rhs[i]){
+returnfalse
 }
+}
+
+returntrue
+}
 
-returnentry.vary[headerName]===key.headers[headerName]
-}))
-))
+returnlhs===rhs
 }
 
 module.exports=MemoryCacheStore

deps/undici/src/lib/cache/sqlite-cache-store.js

@@ -454,7 +454,13 @@ function headerValueEquals (lhs, rhs) {
 returnfalse
 }
 
-returnlhs.every((x,i)=>x===rhs[i])
+for(leti=0;i<lhs.length;i++){
+if(lhs[i]!==rhs[i]){
+returnfalse
+}
+}
+
+returntrue
 }
 
 returnlhs===rhs

deps/undici/src/lib/core/request.js

@@ -390,7 +390,13 @@ function processHeader (request, key, val) {
 }elseif(typeofval[i]==='object'){
 thrownewInvalidArgumentError(`invalid ${key} header`)
 }else{
-arr.push(`${val[i]}`)
+// Coerce primitives (and reject unsafe coercions such as functions
+// with a crafted toString/Symbol.toPrimitive).
+conststr=`${val[i]}`
+if(!isValidHeaderValue(str)){
+thrownewInvalidArgumentError(`invalid ${key} header`)
+}
+arr.push(str)
 }
 }
 val=arr
@@ -401,7 +407,12 @@ function processHeader (request, key, val) {
 }elseif(val===null){
 val=''
 }else{
+// Coerce primitives (and reject unsafe coercions such as functions
+// with a crafted toString/Symbol.toPrimitive).
 val=`${val}`
+if(!isValidHeaderValue(val)){
+thrownewInvalidArgumentError(`invalid ${key} header`)
+}
 }
 
 if(headerName==='host'){

deps/undici/src/lib/dispatcher/client-h1.js

@@ -10,6 +10,7 @@ const {
  RequestContentLengthMismatchError,
  ResponseContentLengthMismatchError,
  RequestAbortedError,
+ InvalidArgumentError,
  HeadersTimeoutError,
  HeadersOverflowError,
  SocketError,
@@ -1134,8 +1135,16 @@ function writeH1 (client, request) {
 }
 body=bodyStream.stream
 contentLength=bodyStream.length
-}elseif(util.isBlobLike(body)&&request.contentType==null&&body.type){
-headers.push('content-type',body.type)
+}elseif(util.isBlobLike(body)&&request.contentType==null){
+constcontentType=body.type
+if(contentType){
+constcontentTypeValue=`${contentType}`
+if(!util.isValidHeaderValue(contentTypeValue)){
+util.errorRequest(client,request,newInvalidArgumentError('invalid content-type header'))
+returnfalse
+}
+headers.push('content-type',contentTypeValue)
+}
 }
 
 if(body&&typeofbody.read==='function'){