hyperium / hyperium/http

`PartialEq`/`Ord` impls for `Authority` ignores case of userinfo part

Open
#625 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.4k
Forks
378
Avg merge
1d 21h
Merged PRs (30d)
5

Description

The comparison traits are implemented for http::uri::Authority by case-insensitively comparing the underlying authority string. This works fine if the authority component only consists of the host subcomponent (and optionally the port subcomponent), which is case-insensitive according to RFC 3986 Section 6.2.2.1.

However, the authority component may also contain a (deprecated according to [RFC 9110 Section 4.2.4.]) userinfo subcomponent, which is not specified to be case-insensitive and thus should be compared case-sensitively. In particular, the following test should pass:

use http::uri::Authority;

#[test]
fn userinfo_eq_case_sensitive() {
    assert_ne!(
        Authority::from_static("alice:supersecurepassword@example.com"),
        Authority::from_static("Alice:SuperSecurePassword@example.com")
    );
}

But this fails with the current implementation.

Is the behavior intentional? I understand that complicating the implementation for the deprecated subcomponent might not be desirable. But I think this should at least be documented if it's intentional.

[RFC 9110 Section 4.2.4.]: https://datatracker.ietf.org/doc/html/rfc9110#section-4.2.4

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the http::uri::Authority implementations of PartialEq and Ord, then reproduce the issue with the userinfo_eq_case_sensitive test shown in the report. Check how authority components are parsed and compared. Done means the comparison behavior matches the RFC distinction for userinfo, or the intentional behavior is clearly documented, with regression coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.