multi-value content-disposition header value results in invalid header value

[ArsalanDotMe]

Version

v20.8.0

Platform

Darwin A-KM20V94RKQ 23.1.0 Darwin Kernel Version 23.1.0: Mon Oct 9 21:27:24 PDT 2023; root:xnu-10002.41.9~6/RELEASE_ARM64_T6000 arm64

Subsystem

http

What steps will reproduce the bug?

const http = require('http');

const server = http.createServer((req, res) => {
 if (req.url === '/api/works') {
 const someString = 'Hello world!';
 const buffer = Buffer.from(someString, 'utf8');
 res.setHeader('Content-Disposition', 'attachment; filename="hello.txt"');
 res.end(buffer);
 } else if (req.url === '/api/fails') {
 const someString = 'Hello world!';
 const buffer = Buffer.from(someString, 'utf8');
 res.setHeader('Content-Disposition', ['attachment; filename="hello.txt"']);
 // returns ERR_INVALID_HTTP_RESPONSE in Chrome, fails with a 502 on ALB
 res.end(buffer);
 }
});

const port = 3000;
server.listen(port, () => {
 console.log(`Server is running on port ${port}`);
});

How often does it reproduce? Is there a required condition?

It is always reproducible.

What is the expected behavior? Why is that the expected behavior?

Expected behavior is that an array can be passed as a value for the content-disposition header just like any other header.

What do you see instead?

Passing an array as a value to content-disposition header results in invalid header value.

Additional information

Issue introduced by #46528

[geirbak]

Hi, given that this was introduced in 18.16.0, should it not be fixed also in the Node.js 18 LTS version?

[einarq]

Hi, given that this was introduced in 18.16.0, should it not be fixed also in the Node.js 18 LTS version?

@ArsalanDotMe
Do you know if we can expect a fix for the 18 LTS for this?
We have LTS versions of our own software that depend on node 18. Creating new versions of our own LTS to support node 20 instead is not feasible for us.

[ArsalanDotMe]

I'm not part of the maintaining team. I just created the issue and made a proposal for the fix.

cc @climba03003 @mcollina @ShogunPanda

[climba03003]

I can see the tag is added in the fix PR. It should be eventually landed in v18.