Keep Link header parameter values that contain '=' - #7520
Conversation
This comment was marked as low quality.
This comment was marked as low quality.
parse_header_links split each parameter on '=' without a maxsplit, so a quoted
value containing '=' (allowed by RFC 8288) produced 3+ parts and raised
ValueError. The bare 'except ValueError: break' then silently dropped that
parameter and every parameter after it in the link.
Use split('=', 1) so the value keeps its '=' and later parameters survive.
|
Added the quoted semicolon regression and a quote-aware parameter splitter, then rebased onto current main. tests/test_utils.py: 230 passed, 1 skipped. Full suite: 632 passed, 3 skipped; one unrelated Windows TLS test could not find tests/certs/valid/ca/ca.crt. |
028edad to
b536520
Compare
|
the inner param split is quote-aware now, but the outer |
parse_header_links split individual link entries on ", *<" without regard for quoting, so a quoted parameter value containing a comma immediately followed by '<' (RFC 8288 quoted-strings may contain commas) was mistaken for the separator between two links, corrupting the entry into two bogus ones. Reuse the same quote-tracking approach as the parameter splitter for the entry splitter.
|
Good catch, thanks — that's a real gap. Fixed by making the entry splitter quote-aware too (same state-machine approach as Added |
Summary
parse_header_linkssplits eachLinkheader parameter on=withkey, value = param.split("=")(nomaxsplit). RFC 8288 permits quotedparameter values that themselves contain
=(pagination/cursor tokens,base64 values, signed URLs, etc.). Such a value produces 3+ parts and raises
ValueError: too many values to unpack, which the bareexcept ValueError: breakswallows — silently dropping that parameter and every parameter afterit in the link.
Fix
param.split("=")→param.split("=", 1)inparse_header_links, so the valuekeeps its
=and following parameters are preserved.Tests
Added a
test_parse_header_linksparametrization with a value containing=(
title="a=b"followed byrel="next"). It fails onmain(bothtitleandthe trailing
relare dropped) and passes with the fix.tests/test_utils.py::test_parse_header_linksis green (6 passed);
ruff check/ruff formatclean.No existing issue tracked this; the bug is long-standing.