From 7a108d409babdcf2f3ee98d667e99378646364e6 Mon Sep 17 00:00:00 2001 From: Rob Ede Date: Mon, 2 Nov 2026 19:17:19 +0200 Subject: [PATCH] Reject invalid RFC 850 date separators --- src/date.rs | 2 +- src/lib.rs | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/src/date.rs b/src/date.rs index 8bc0a3b..000afbe 100644 --- a/src/date.rs +++ b/src/date.rs @@ -333,7 +333,7 @@ fn parse_rfc850_date(s: &[u8]) -> Result { .or_else(|| wday(s, 6, b"Saturday, ")) .or_else(|| wday(s, 7, b"Sunday, ")) .ok_or(Error(()))?; - if s.len() != 22 || s[12] != b':' || s[15] != b':' || &s[18..22] != b" GMT" { + if s.len() != 22 || s[9] != b' ' || s[12] != b':' || s[15] != b':' || &s[18..22] != b" GMT" { return Err(Error(())); } let mut year = u16::from(toint_2(&s[7..9])?); diff --git a/src/lib.rs b/src/lib.rs index 88cb6fa..a0d0926 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -82,6 +82,17 @@ mod tests { assert_eq!(d, parse_http_date("Sun Nov 6 08:49:37 1994").expect("#3")); } + #[test] + fn test_rfc850_requires_space_before_time() { + assert!(parse_http_date("Sunday, 06-Nov-94 08:49:37 GMT").is_ok()); + + for separator in ["X", "\t", "0"] { + let date = format!("Sunday, 06-Nov-94{}08:49:37 GMT", separator); + + assert!(parse_http_date(&date).is_err(), "accepted {:?}", date); + } + } + #[test] fn test2() { let d = UNIX_EPOCH + Duration::from_secs(1475419451);