http-types icon indicating copy to clipboard operation
http-types copied to clipboard

Non ASCII header values causes panic

Open x1125 opened this issue 7 months ago • 2 comments

I came here via an unexpected panic in my tide webserver, but I think the problem belongs here. When I'm using a cookie that might be a bit "odd" like password=Â , the calling library (async-h1 or tide) is calling append_header from request.rs, then append and insert within the headers/headers.rs file to set that header. On line 54 it says: let values: HeaderValues = values.to_header_values().unwrap().collect(); which fails and panics with a Result::unwrap() on an Err value: String slice should be valid ASCII. I think those functions should have a result of type Result<T, E> if these functions can fail in such circumstances.

x1125 avatar Nov 12 '23 20:11 x1125

In the past, http-rs held tight to disallowing things disallowed by existing http rfcs.

However in RFC 9110 "HTTP Semantics" (June 2022) under the "Field Values" (5.5) section it says:

Specifications for newly defined fields SHOULD limit their values to visible US-ASCII octets (VCHAR), SP, and HTAB. A recipient SHOULD treat other allowed octets in field content (i.e., obs-text) as opaque data.

To me this sounds as if http-rs treats this incorrectly. Instead of causing an error, the RFC indicated non-ascii octets should generally be preserved in some way, at least as i read it.

Fishrock123 avatar Jan 04 '24 20:01 Fishrock123

this is fixed in https://github.com/OneOfOne/http-types-rs/commit/82270e7322a82fb751116b5e9d8a90cc7c11c8f6

OneOfOne avatar Apr 08 '24 17:04 OneOfOne