Skip to content

fix(uri): reject trailing path, query or fragment in Authority::from_static - #881

Closed
G26karthik wants to merge 1 commit into
hyperium:masterfrom
G26karthik:fix/authority-from-static-trailing
Closed

G26karthik wants to merge 1 commit into
hyperium:masterfrom
G26karthik:fix/authority-from-static-trailing

Conversation

@G26karthik

Copy link
Copy Markdown

Closes #879

Authority::from_static("https://127.0.0.1") returns an Authority without panicking, while "https://127.0.0.1".parse::<Authority>() returns an error.

Both call validate_authority_bytes, which stops at the first /, ? or # and returns that position as the end of the authority. create_authority (used by parse) compares that position to the input length and rejects the input if there is leftover data. from_static matched on Ok(_) and threw the position away, so anything after the first /, ? or # was accepted as part of the authority.

from_static now only accepts Ok(end) when end == src.len(), so it agrees with parse and is still const.

Tests:

  • Added from_static_rejects_trailing_path in src/uri/authority.rs. It fails on master (the call does not panic) and passes with this change.
  • cargo test passes (422 tests). cargo fmt is not installed here, so I formatted by hand.

@G26karthik

Copy link
Copy Markdown
Author

Closing this so the issue author can take it. Sorry for the noise.

@G26karthik G26karthik closed this Oct 31, 2026
@G26karthik
G26karthik deleted the fix/authority-from-static-trailing branch October 31, 2026 18:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Authority::from_static does not perform adequate validation

1 participant