Raw HTTP header parser

Question

1. The code must produce the desired output

Input

GET / HTTP/1.1
Host: 
Connection: Upgrade
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Upgrade: websocket
Origin: scheme://XXXXXXXXXXXXXXXXXXXXXXXX
Sec-WebSocket-Version: 13
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Sec-WebSocket-Key: XXXXXXXXXXXXXXXXXXXXXXXX
Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits0.0.0.0:8080

Code

function getHeaders(rawHeaders) {
  const arr = rawHeaders.match(/.+/g).map((line) => line.split(/:\s|\s\/\s/));
  console.log(arr);
  return new Headers(arr);
}

Result

console.log(JSON.stringify([...getHeaders(rawHttpHeaders)], null, 2));
VM550:17 (13) [Array(2), Array(2), Array(2), Array(2), Array(2), Array(2), Array(2), Array(2), Array(2), Array(2), Array(2), Array(2), Array(2)]
VM550:21 [
  [
    "accept-encoding",
    "gzip, deflate"
  ],
  [
    "accept-language",
    "en-US,en;q=0.9"
  ],
  [
    "cache-control",
    "no-cache"
  ],
  [
    "connection",
    "Upgrade"
  ],
  [
    "get",
    "HTTP/1.1"
  ],
  [
    "host",
    ""
  ],
  [
    "origin",
    "scheme://XXXXXXXXXXXXXXXXXXXXXXXX"
  ],
  [
    "pragma",
    "no-cache"
  ],
  [
    "sec-websocket-extensions",
    "permessage-deflate; client_max_window_bits0.0.0.0:8080"
  ],
  [
    "sec-websocket-key",
    "XXXXXXXXXXXXXXXXXXXXXXXX"
  ],
  [
    "sec-websocket-version",
    "13"
  ],
  [
    "upgrade",
    "websocket"
  ],
  [
    "user-agent",
    "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
  ]
]

2. The code must not error or contain known bugs X
3. The title should describe what the code does X
4. The more code you provide the more we can help X

Answer 1

Since the HTTP headers aren't in the control of the application using regular expressions to handle them is subject to vulnerabilities. Going through OWASP recommendations for processing input with regular expressions could be useful or replace the use of regular expressions with plain conditional statements to be on the safe side.