fix: enforce Content-Type singleton guard in response.set() object form

__tests__/response/set.test.js

@@ -43,3 +43,21 @@ describe('ctx.set(object)', () => {
     assert.strictEqual(ctx.response.header.bar, '2')
   })
 })
+
+describe('ctx.set(object) Content-Type singleton guard', () => {
+  it('should throw when Content-Type is set to an array via the object form', () => {
+    const ctx = context()
+    assert.throws(
+      () => ctx.set({ 'Content-Type': ['text/html', 'text/plain'] }),
+      { message: 'Assign multiple Content-Type for response header is not allowed' }
+    )
+  })
+
+  it('should throw regardless of header name casing in the object form', () => {
+    const ctx = context()
+    assert.throws(
+      () => ctx.set({ 'content-type': ['application/json', 'text/plain'] }),
+      { message: 'Assign multiple Content-Type for response header is not allowed' }
+    )
+  })
+})

lib/response.js

@@ -543,7 +543,12 @@ module.exports = {
       }
       this.res.setHeader(field, val)
     } else {
-      Object.keys(field).forEach(header => this.res.setHeader(header, field[header]))
+      Object.keys(field).forEach(header => {
+        if (header.toLowerCase() === 'content-type') {
+          assert(!Array.isArray(field[header]), 'Assign multiple Content-Type for response header is not allowed')
+        }
+        this.res.setHeader(header, field[header])
+      })
     }
   },