fix(content-type): escape quoted-pairs when serializing parameters - #7022

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added — N/A, no public API change
• commit message and code follow the Code of conduct

No open issue — found by auditing lib/content-type.js.

The bug

The constructor unescapes quoted-pairs, as RFC 9110 §5.6.4 requires of a recipient:

if (value.indexOf('\\') !== -1) {
  value = value.replace(quotedPairReg, '$1')
}

So a stored parameter value can contain a DQUOTE or a backslash. toString() then wrapped it in DQUOTEs verbatim:

parameters.push(`${key}="${value}"`)

which produces a header that no longer parses back to the same value:

Why it is not only cosmetic

toString() is the normalized key that custom parsers are registered and looked up under — ContentTypeParser.prototype.add stores ct.toString(), and getParser looks up contentType.toString() for the incoming request. Because the escaping is dropped, two different content types collapse onto one key:

new ContentType('text/plain; p="a\\"; q=\\"b"')  // 1 parameter: p === 'a"; q="b'
new ContentType('text/plain; p="a"; q="b"')      // 2 parameters: p === 'a', q === 'b'
// both serialize to:  text/plain; p="a"; q="b"

A parser registered for the first therefore runs for requests carrying the second. There is a test for exactly this through inject.

The fix

Precede each DQUOTE and backslash with a backslash when serializing, which is what RFC 9110 §5.6.4 requires of a sender. A value containing neither octet is unchanged, so the existing toString() assertions in test/content-type.test.js are untouched.

I deliberately did not also stop quoting values that are bare tokens (charset=utf-8 still serializes as charset="utf-8"). That round-trips correctly today, and changing it would alter every existing parser key — a separate question from this bug.

Verification

• 4 new tests fail before the change, pass after
• npm run unit: 2345 tests, 0 failures
• npm run lint clean, npm run test:types clean (1282 assertions)