fix: treat space as a delimiter in content-type parsing

[mcollina]

Follow-up from GHSA-mg2h-6x62-wpwc

[mcollina]

Unfortunately, the fix from GHSA-mg2h-6x62-wpwc left a hole open. At this point, it's better to close the gap completely.

This is quite urgent.

[mcollina]

Will do something slightly differently

[jsumners]

We shouldn't ever see headers written like this (https://httpwg.org/specs/rfc9110.html#media.type). The spec is <type>[;][<parameter>]. But I suppose we have to handle this case due to jerks. However, it feel like a slippery slope to me.

Anyway, I think we might be able to eek out some more performance with slice instead:

'use strict'

const iterations = 1_000_000
const hrtime = process.hrtime.bigint
const fixture = 'application/json foo; charset=utf-8'

const startSplit = hrtime()
for (var i = 0; i < iterations; i += 1) {
  const result = fixture.split(/[ ;]/, 1)[0].trim().toLowerCase()
  doSomething(result)
}
const endSplit = hrtime()

const startSlice = hrtime()
for (var i = 0; i < iterations; i += 1) {
  const result = fixture.slice(
    0, fixture.indexOf(' ')
  ).replace(';', '').trim().toLowerCase()
  doSomething(result)
}
const endSlice = hrtime()

const splitTime = endSplit - startSplit
console.log('split:', splitTime)

const sliceTime = endSlice - startSlice
console.log('slice:', sliceTime)

console.log('split > slice =', splitTime > sliceTime)

function doSomething(value) {
  return value >> 1
}