http-rs / http-rs/http-types

Splitting on comma to parse the Accept header is wrong

Open
#349 8 comments 0 reactions 0 assignees View on GitHub
bug good first issue
Dominant language
Rust
Stars
209
Forks
91
PR merge metrics
No merged PRs in 30d

Description

[RFC 7231 section 5.3.2](https://tools.ietf.org/html/rfc7231#section-5.3.2) says:

> The "Accept" header field can be used by user agents to specify response media types that are acceptable. Accept header fields can be used to indicate that the request is specifically limited to a small set of desired types, as in the case of a request for an in-line image.
>
> Accept = #( media-range [ accept-params ] )
>
> media-range = ( "*/*"
> / ( type "/" "*" )
> / ( type "/" subtype )
> ) *( OWS ";" OWS parameter )
> accept-params = weight *( accept-ext )
> accept-ext = OWS ";" OWS token [ "=" ( token / quoted-string ) ]

Note that `accept-ext` accepts a `quoted-string` after the equal sign, which means the values can include commas.

[The parsing code for `Accept`](https://github.com/http-rs/http-types/blob/b3a9b9615936adc6727027a00c4b107c0a9ba875/src/content/accept.rs#L66-L95) splits the `Accept` header values on comma and then parses each segment with `MediaTypeProposal::from_str`.

That means that `Accept: foo/bar; parisien="baguette, jambon, fromage"` will parse incorrectly.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.