Fix naive content-type sniffing implementation (#940)

* Fix naive content-type sniffing implementation * yarn
mui · Sep 8, 2022 · 46d7581 · 46d7581
1 parent 8fb2a08
commit 46d7581
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 1 deletion.
diff --git a/packages/toolpad-app/package.json b/packages/toolpad-app/package.json
@@ -101,6 +101,7 @@
     "ts-node": "^10.9.1",
     "typescript": "^4.8.2",
     "web-streams-polyfill": "^3.2.1",
+    "whatwg-mimetype": "^3.0.0",
     "whatwg-url": "^11.0.0"
   },
   "devDependencies": {
@@ -118,6 +119,7 @@
     "@types/react-dom": "^18.0.6",
     "@types/react-inspector": "^4.0.2",
     "@types/serialize-javascript": "^5.0.2",
+    "@types/whatwg-mimetype": "^2.1.1",
     "@types/whatwg-url": "^11.0.0",
     "ajv": "^8.11.0",
     "eslint": "8.23.0",

diff --git a/packages/toolpad-app/src/toolpadDataSources/rest/server.ts b/packages/toolpad-app/src/toolpadDataSources/rest/server.ts
@@ -1,5 +1,6 @@
 import { BindableAttrEntries, BindableAttrValue, BindableAttrValues } from '@mui/toolpad-core';
 import fetch, { Headers, RequestInit, Response } from 'node-fetch';
+import MIMEType from 'whatwg-mimetype';
 import { withHarInstrumentation, createHarLog } from '../../server/har';
 import { ServerDataSource, ApiResult } from '../../types';
 import {
@@ -112,8 +113,18 @@ async function resolveBody(body: Body, boundValues: Record<string, string>) {
   }
 }
 
+function isJSON(mimeType: MIMEType): boolean {
+  // See https://mimesniff.spec.whatwg.org/#json-mime-type
+  const essence = `${mimeType.type}/${mimeType.subtype}`;
+  return (
+    essence === 'text/json' || essence === 'application/json' || mimeType.subtype.endsWith('+json')
+  );
+}
+
 async function readData(res: Response): Promise<any> {
-  return res.headers.get('content-type') === 'application/json' ? res.json() : res.text();
+  const contentType = res.headers.get('content-type');
+  const mimeType = contentType ? new MIMEType(contentType) : null;
+  return mimeType && isJSON(mimeType) ? res.json() : res.text();
 }
 
 async function execBase(

diff --git a/yarn.lock b/yarn.lock
@@ -2946,6 +2946,11 @@
   resolved "https://registry.yarnpkg.com/@types/webidl-conversions/-/webidl-conversions-7.0.0.tgz#2b8e60e33906459219aa587e9d1a612ae994cfe7"
   integrity sha512-xTE1E+YF4aWPJJeUzaZI5DRntlkY3+BCVJi0axFptnjGmAoWxkyREIh/XMrfxVLejwQxMCfDXdICo0VLxThrog==
 
+"@types/whatwg-mimetype@^2.1.1":
+  version "2.1.1"
+  resolved "https://registry.yarnpkg.com/@types/whatwg-mimetype/-/whatwg-mimetype-2.1.1.tgz#1b7b7aecaa3695209fd2f3a808dd5729973a52fa"
+  integrity sha512-ojnf89qt5AWnqsjyPqMLN8uVaxm5x23vxNQ1me6EPBOdJe1YYuIZUzg809MZUG8UU6HKhkr6ah4fi2WUvD0DFw==
+
 "@types/whatwg-url@^11.0.0":
   version "11.0.0"
   resolved "https://registry.yarnpkg.com/@types/whatwg-url/-/whatwg-url-11.0.0.tgz#5c42518a163a6867e14235223a1a558143bccbab"