Skip to content

Panics with non-ASCII header value #853

Description

@IVogel

It panics due to lack of the string validity check in async-h1 and due to unwrap in http-types. Also, there is second unwrap that will panic if two fields with similar values exists, but second has valid UTF-8 string.

Minimal code for replication

#[async_std::main]
async fn main() -> tide::Result<()> {
    let mut app = tide::new();
    app.at("/").get( |_| async {
        Ok(tide::Response::new(200))
    });
    app.listen("0.0.0.0:8080").await?;
    Ok(())
}

Note, header value should be an valid UTF-8 string.

curl --header "Test: тест" http://0.0.0.0:8080
# or
curl --header "Test: test" --header "Test: тест" http://0.0.0.0:8088

Sorry if this is wrong repo. I don't really know to which repo this issue related to, because tide uses async-h1 which uses http-types. And I have got this error while using tide.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions