mafintosh / mafintosh/csv-parser

raw: true yields empty rows since 3.2.1 — all headers nulled by sanitizeHeader's string type check

Open Beginner friendly
#251 0 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
1.5k
Forks
143
PR merge metrics
No merged PRs in 30d

Description

* Operating System: macOS 15.7.3 (Darwin 24.6.0)
* Node Version: 24.16.0
* NPM Version: 11.13.0
* csv-parser Version: 3.2.1

### Expected Behavior

When using the `raw: true` option, rows should be parsed into objects keyed by the CSV headers, with Buffer values — as in 3.2.0 and earlier:

```
headers: [ , ]
row: { a: , b: }
row: { a: , b: }
```

### Actual Behavior

Since 3.2.1, every header is mapped to `null` and every row comes back as an empty object — all columns are silently dropped:

```
headers: [ null, null ]
row: {}
row: {}
```

Cause: the prototype pollution fix from #250 added `sanitizeHeader()`, whose first check is `if (typeof header !== 'string') return null`. With `raw: true`, `parseValue()` returns Buffers for every cell — including the header row — so every header fails the type check, becomes `null`, and is treated as a "skip this column" marker by `writeRow()`. The same regression hits any custom `mapHeaders` that returns a non-string value.

The dangerous-key check (`__proto__`, `constructor`, `prototype`) doesn't require rejecting non-strings outright — e.g. Buffer headers could be compared via their string form instead of being discarded.

### How Do We Reproduce?

```js
const csv = require('csv-parser')
const { Readable } = require('stream')

Readable.from('a,b\n1,2\n3,4\n')
.pipe(csv({ raw: true }))
.on('headers', (h) => console.log('headers:', h))
.on('data', (row) => console.log('row:', row))
```

Run with `csv-parser@3.2.1` → `headers: [ null, null ]`, all rows `{}`.
Run with `csv-parser@3.2.0` → headers and rows populated as expected.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the regression with the provided Readable stream and raw:true example, then inspect sanitizeHeader, parseValue, and writeRow. Done means raw headers are retained, Buffer-valued rows are populated as in 3.2.0, and the custom non-string mapHeaders case is considered without weakening the dangerous-key protection.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
data
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
75/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.