Function escapeHeaderParam

lib/form_data.js:26–28

* Escape CR, LF, and `"` in a multipart `name`/`filename` parameter, so a field * name or filename can not break out of its header line to inject headers or * smuggle additional parts. Matches the WHATWG HTML multipart/form-data encoding. * * @param {string} str - the parameter value to escape

(str)

 * @returns {string} the escaped value
 */
function escapeHeaderParam(str) {
  return String(str).replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
}

/**
 * Create readable "multipart/form-data" streams.