Merge commit from fork

* fix: trim horizontal tabs (HTAB) in multi-entry X-Forwarded-For parser

RFC 7230 §3.2.3 defines OWS as *( SP / HTAB ). The multi-entry parser
only recognized SP (0x20) but not HTAB (0x09), leaving tab characters
preserved in returned address strings. This allowed security-control
evasion via exact-string-match bypasses when the header has 2+ comma-
separated values.

The single-entry fast path was unaffected because it uses JavaScript's
built-in .trim(), which already strips tabs.

Fixes GHSA-2849-m2w7-xm8f.

* test: cover HTAB (tab) OWS trimming

Ref: GHSA-2849-m2w7-xm8f

---------

Co-authored-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>

Author: mcollina

index.js

@@ -39,7 +39,7 @@ function parse (header, socketAddr) {
 
   for (i = end - 1; i >= 0; --i) {
     char = header[i]
-    if (char === ' ') {
+    if (char === ' ' || char === '\t') {
       (start === end) && (start = end = i)
     } else if (char === ',') {
       (start !== end) && result.push(header.slice(start, end))

test/test.js

@@ -114,6 +114,30 @@ test('should trim trailing OWS after a comma', function (t) {
   ])
 })
 
+test('should trim leading OWS with tabs (HTAB)', function (t) {
+  t.plan(1)
+  const req = createReq('127.0.0.1', {
+    'x-forwarded-for': '\t10.0.0.2\t,\t10.0.0.1'
+  })
+  t.assert.deepStrictEqual(forwarded(req), [
+    '127.0.0.1',
+    '10.0.0.1',
+    '10.0.0.2'
+  ])
+})
+
+test('should trim trailing OWS with tabs (HTAB)', function (t) {
+  t.plan(1)
+  const req = createReq('127.0.0.1', {
+    'x-forwarded-for': '10.0.0.2\t,\t10.0.0.1\t'
+  })
+  t.assert.deepStrictEqual(forwarded(req), [
+    '127.0.0.1',
+    '10.0.0.1',
+    '10.0.0.2'
+  ])
+})
+
 function createReq (socketAddr, headers) {
   return {
     socket: {