feat: improved authority validation checks - #861
Open
tremwil wants to merge 1 commit into
Open
Conversation
tremwil
force-pushed
the
feat/improved-authority-validation
branch
from
August 10, 2026 12:24
fc20eb4 to
c04d8ce
Compare
Rewrites the `http::uri::Authority` validation to follow RFC 3986 more strictly, rejecting a illegal authorities that are currently accepted (such as broken IPv6 literals or non-digit ports). All validation code is written such that it can execute in a `const` context, to maintain support for `Authority::from_static`. At the same time, this allows the host to be percent-encoded. Allowed percent encodings are restricted to characters that can't be encoded as-is to prevent url-confusion attacks with authorities that the crate currently accepts. That is, authorities that are semantically equivalent to a previously acccepted one but compare differently due to the use of percent encodings will be rejected.
tremwil
force-pushed
the
feat/improved-authority-validation
branch
from
August 10, 2026 15:39
c04d8ce to
27407fc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rewrites the
http::uri::Authorityvalidation to follow RFC 3986 more strictly, rejecting a illegal authorities that are currently accepted (such as broken IPv6 literals or non-digit ports).All validation code is written such that it can execute in a
constcontext, to maintain support forAuthority::from_static.At the same time, this allows the host to be percent-encoded. Allowed percent encodings are restricted to characters that can't be encoded as-is to prevent url-confusion attacks with authorities that the crate currently accepts. That is, authorities that are semantically equivalent to a previously accepted one but compare differently due to the use of percent encodings are rejected. This would unblock usecases such as #836 (comment) and #528 while hopefully addressing the security concerns laid out in #528 (comment).