http: preserve raw header duplicates in writeHead after setHeader calls

writeHead accepts a raw header array, which is intended to allow
directly specifying raw header details, such as ordering, duplicates
and header key casing. When used by itself this works correctly.

However, if setHeader was called first, it effectively changed the
behaviour of subsequent writeHead calls, so that even if a raw header
array was provided, duplicates were collapsed, losing raw header data.

This change preserves the raw headers passed to writeHead, while still
maintaining the 'writeHead overwrites setHeader' behaviour.

PR-URL: #50394
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: James M Snell <[email protected]>

lib/_http_server.js

@@ -373,9 +373,18 @@ function writeHead(statusCode, reason, obj) {
         throw new ERR_INVALID_ARG_VALUE('headers', obj);
       }
 
+      // Headers in obj should override previous headers but still
+      // allow explicit duplicates. To do so, we first remove any
+      // existing conflicts, then use appendHeader.
+
+      for (let n = 0; n < obj.length; n += 2) {
+        k = obj[n + 0];
+        this.removeHeader(k);
+      }
+
       for (let n = 0; n < obj.length; n += 2) {
         k = obj[n + 0];
-        if (k) this.setHeader(k, obj[n + 1]);
+        if (k) this.appendHeader(k, obj[n + 1]);
       }
     } else if (obj) {
       const keys = ObjectKeys(obj);

test/parallel/test-http-write-head-after-set-header.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const common = require('../common');
+const Countdown = require('../common/countdown');
+const assert = require('assert');
+const { createServer, request } = require('http');
+
+const server = createServer(common.mustCall((req, res) => {
+  if (req.url.includes('setHeader')) {
+    res.setHeader('set-val', 'abc');
+  }
+
+  res.writeHead(200, [
+    'array-val', '1',
+    'array-val', '2',
+  ]);
+
+  res.end();
+}, 2));
+
+const countdown = new Countdown(2, () => server.close());
+
+server.listen(0, common.mustCall(() => {
+  request({
+    port: server.address().port
+  }, common.mustCall((res) => {
+    assert.deepStrictEqual(res.rawHeaders.slice(0, 4), [
+      'array-val', '1',
+      'array-val', '2',
+    ]);
+
+    countdown.dec();
+  })).end();
+
+  request({
+    port: server.address().port,
+    path: '/?setHeader'
+  }, common.mustCall((res) => {
+    assert.deepStrictEqual(res.rawHeaders.slice(0, 6), [
+      'set-val', 'abc',
+      'array-val', '1',
+      'array-val', '2',
+    ]);
+
+    countdown.dec();
+  })).end();
+}));