Authorization::value and WwwAuthenticate::value can violate ASCII invariants
Authorization::value uses HeaderValue::value with the claim
that the internal string is ASCII, but Authorization::new and
Authorization::set_credentials accept arbitrary String credentials without
validation. As a result, safe code can construct a header value containing
non-ASCII UTF-8 while the implementation assumes ASCII.
WwwAuthenticate::new and WwwAuthenticate::set_realm similarly accepts arbitrary String input, so WwwAuthenticate::value can also produce a header value that violates the crate’s documented ASCII invariants.
This issue has not been confirmed as Undefined Behavior, but the unsafe
justification in Authorization::value and WwwAuthenticate::value appears incorrect and can produce values outside the expected ASCII-only constraints.
The http-types crate is unmaintained and the issue is unlikely to be fixed.
See advisory page for additional details.
http-types2.12.0Authorization::valueusesHeaderValue::valuewith the claimthat the internal string is ASCII, but
Authorization::newandAuthorization::set_credentialsaccept arbitraryStringcredentials withoutvalidation. As a result, safe code can construct a header value containing
non-ASCII UTF-8 while the implementation assumes ASCII.
WwwAuthenticate::newandWwwAuthenticate::set_realmsimilarly accepts arbitraryStringinput, soWwwAuthenticate::valuecan also produce a header value that violates the crate’s documented ASCII invariants.This issue has not been confirmed as Undefined Behavior, but the unsafe
justification in
Authorization::valueandWwwAuthenticate::valueappears incorrect and can produce values outside the expected ASCII-only constraints.The http-types crate is unmaintained and the issue is unlikely to be fixed.
See advisory page for additional details.