mafintosh / mafintosh/csv-parser
raw: true yields empty rows since 3.2.1 — all headers nulled by sanitizeHeader's string type check
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1.5k
- Forks
- 143
- PR merge metrics
- No merged PRs in 30d
Description
* Operating System: macOS 15.7.3 (Darwin 24.6.0)
* Node Version: 24.16.0
* NPM Version: 11.13.0
* csv-parser Version: 3.2.1
### Expected Behavior
When using the `raw: true` option, rows should be parsed into objects keyed by the CSV headers, with Buffer values — as in 3.2.0 and earlier:
```
headers: [ , ]
row: { a: , b: }
row: { a: , b: }
```
### Actual Behavior
Since 3.2.1, every header is mapped to `null` and every row comes back as an empty object — all columns are silently dropped:
```
headers: [ null, null ]
row: {}
row: {}
```
Cause: the prototype pollution fix from #250 added `sanitizeHeader()`, whose first check is `if (typeof header !== 'string') return null`. With `raw: true`, `parseValue()` returns Buffers for every cell — including the header row — so every header fails the type check, becomes `null`, and is treated as a "skip this column" marker by `writeRow()`. The same regression hits any custom `mapHeaders` that returns a non-string value.
The dangerous-key check (`__proto__`, `constructor`, `prototype`) doesn't require rejecting non-strings outright — e.g. Buffer headers could be compared via their string form instead of being discarded.
### How Do We Reproduce?
```js
const csv = require('csv-parser')
const { Readable } = require('stream')
Readable.from('a,b\n1,2\n3,4\n')
.pipe(csv({ raw: true }))
.on('headers', (h) => console.log('headers:', h))
.on('data', (row) => console.log('row:', row))
```
Run with `csv-parser@3.2.1` → `headers: [ null, null ]`, all rows `{}`.
Run with `csv-parser@3.2.0` → headers and rows populated as expected.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the regression with the provided Readable stream and raw:true example, then inspect sanitizeHeader, parseValue, and writeRow. Done means raw headers are retained, Buffer-valued rows are populated as in 3.2.0, and the custom non-string mapHeaders case is considered without weakening the dangerous-key protection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- data
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 75/100