Skip to content

fix(res.links): skip empty-array rel values to prevent trailing comma in Link header#7320

Open
JSap0914 wants to merge 1 commit into
expressjs:masterfrom
JSap0914:fix/res-links-empty-array-rel
Open

fix(res.links): skip empty-array rel values to prevent trailing comma in Link header#7320
JSap0914 wants to merge 1 commit into
expressjs:masterfrom
JSap0914:fix/res-links-empty-array-rel

Conversation

@JSap0914

Copy link
Copy Markdown

Bug

When res.links() is called with an empty array [] for a rel value, the inner .map().join(', ') produces an empty string ''. The outer .join(', ') then includes that empty entry, yielding an invalid Link header:

res.links({ next: 'http://example.com/2', prev: [] })
// Before: Link: <http://example.com/2>; rel="next",   ← trailing comma, invalid
// After:  Link: <http://example.com/2>; rel="next"

A second call appending only empty-array rels also produced a trailing comma:

res.links({ next: 'http://example.com/2' })
res.links({ prev: [] })
// Before: Link: <http://example.com/2>; rel="next",
// After:  Link: <http://example.com/2>; rel="next"

RFC 8288 requires the Link header to be a comma-separated list of link-values; a trailing comma or empty entry is invalid and may confuse clients or intermediaries.

Fix

Extract the new link entries into newLinks, filter out empty strings with .filter(Boolean), then only prepend ', ' when both the existing Link value and the new entries are non-empty.

Verification

npx mocha --require test/support/env --reporter spec --check-leaks test/res.links.js

Note: This fix was developed with AI-assist.

… in Link header

When res.links() is called with an empty array for a rel value, the inner
.map().join(', ') produces an empty string ''. The outer .join(', ') then
includes that empty entry, resulting in either a trailing comma:

  res.links({ next: 'http://example.com/2', prev: [] })
  // Before: Link: <http://example.com/2>; rel="next",
  // After:  Link: <http://example.com/2>; rel="next"

or a dangling separator when a second call appends nothing:

  res.links({ next: 'http://example.com/2' })
  res.links({ prev: [] })
  // Before: Link: <http://example.com/2>; rel="next",
  // After:  Link: <http://example.com/2>; rel="next"

Fix: collect new link entries first, filter out empty strings with
.filter(Boolean), then only prepend the ', ' separator when both the
existing Link value and the new entries are non-empty.

Fixes: RFC 8288 compliance — Link header values must be a comma-separated
list of link values; an empty string or trailing comma is invalid.
Copilot AI review requested due to automatic review settings June 17, 2026 11:35

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants