Splitting on comma to parse the Accept header is wrong
- Dominant language
- Rust
- Stars
- 209
- Forks
- 91
- PR merge metrics
- No merged PRs in 30d
Description
[RFC 7231 section 5.3.2](https://tools.ietf.org/html/rfc7231#section-5.3.2) says:
> The "Accept" header field can be used by user agents to specify response media types that are acceptable. Accept header fields can be used to indicate that the request is specifically limited to a small set of desired types, as in the case of a request for an in-line image.
>
> Accept = #( media-range [ accept-params ] )
>
> media-range = ( "*/*"
> / ( type "/" "*" )
> / ( type "/" subtype )
> ) *( OWS ";" OWS parameter )
> accept-params = weight *( accept-ext )
> accept-ext = OWS ";" OWS token [ "=" ( token / quoted-string ) ]
Note that `accept-ext` accepts a `quoted-string` after the equal sign, which means the values can include commas.
[The parsing code for `Accept`](https://github.com/http-rs/http-types/blob/b3a9b9615936adc6727027a00c4b107c0a9ba875/src/content/accept.rs#L66-L95) splits the `Accept` header values on comma and then parses each segment with `MediaTypeProposal::from_str`.
That means that `Accept: foo/bar; parisien="baguette, jambon, fromage"` will parse incorrectly.
Contributor guide
Assessment
This issue has not been assessed yet.