fix: prevent CRLF injection in CONNECT request headers

[cursor]

Summary

Fixes a CRLF header injection vulnerability (CWE-113) in buildConnectRequest().

Problem

The buildConnectRequest function in lib/core/utils.js interpolated user-provided header names and values directly into the raw HTTP CONNECT request string without any validation. Since this library constructs raw TCP protocol data (bypassing Node.js's built-in http.validateHeaderName()/http.validateHeaderValue() checks), a malicious value containing \r\n could inject arbitrary headers into the CONNECT request — including overriding Proxy-Authorization credentials.

Example attack payload:

proxyHeaders: { 'X-ProxyMesh-Country': 'US\r\nProxy-Authorization: Basic ZXZpbDpldmls' }

This would produce a CONNECT request where the injected Proxy-Authorization appears as a separate, legitimate header line.

Fix

• Added validateHeaderName(name) and validateHeaderValue(value) functions that reject any string containing \r, \n, or NUL (\0) characters with a descriptive TypeError.
• buildConnectRequest now calls both validators before interpolating each header entry.
• Both validators are also exported from the package root for consumers who want to pre-validate input.

Testing

Verified that:

• Normal headers continue to work as expected
• CRLF in header values throws TypeError
• CRLF in header names throws TypeError
• NUL bytes in values throw TypeError
• Map-based headers are also validated

  

[cursor]

Left a non-blocking comment: not approving because Cursor Bugbot and Cursor Security Agent were not present, this is not a Dependabot version bump, and the integration check failed. Assigned proxymesh and proxymeshai for human review.

  

_{Sent by Cursor Approval Agent: dependabot approver}