hyperium / hyperium/http

`Uri` does not accept percent-encoded characters in hostname

Open
#836 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.4k
Forks
378
Avg merge
1d 21h
Merged PRs (30d)
5

Description

uri::authority::validate_authority_bytes (and thus Authority::from_static/from_maybe_shared) returns Err(AuthorityError::InvalidAuthority) for host names with percent-encoded characters.

I'm not sure if this is intentional, as percent-encoding is explicitly allowed for the userinfo part of the authority in the parsing logic, with this comment referencing RFC3986 (and specifically mentioning that % shouldn't be allowed in a host name):

// Per https://tools.ietf.org/html/rfc3986#section-3.2.1 and
// https://url.spec.whatwg.org/#authority-state
// the userinfo can have a percent-encoded username and password,
// so record that a `%` was found. If this turns out to be
// part of the userinfo, this flag will be cleared.
// Also per https://tools.ietf.org/html/rfc6874, percent-encoding can
// be used to indicate a zone identifier.
// If the flag hasn't been cleared at the end, that means this
// was part of the host name (and not part of an IPv6 address), and
// will fail with an error.

However, RFC3986 section 3.2.2 defines the host part of the authority as

host = IP-literal / IPv4address / reg-name

with reg-name being defined a few paragraphs later as

reg-name = *( unreserved / pct-encoded / sub-delims )

https://url.spec.whatwg.org/#host-parsing also agrees that the host can contain percent-encoded characters. So, from my understanding percent-encoded characters in a host name should be allowed.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/uri/authority.rs at uri::authority::validate_authority_bytes and the Authority::from_static/from_maybe_shared entry points. Compare the validation with RFC3986 section 3.2.2 and the existing userinfo and IPv6 zone-identifier handling described in the issue. Done means the intended behavior for percent-encoded host characters is established and covered by the relevant authority parsing tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.