Skip to content

Fix IndexError in Digest auth header parser on empty values#1023

Open
mbeijen wants to merge 1 commit into
pydantic:mainfrom
mbeijen:fix-unquote-empty-string
Open

Fix IndexError in Digest auth header parser on empty values#1023
mbeijen wants to merge 1 commit into
pydantic:mainfrom
mbeijen:fix-unquote-empty-string

Conversation

@mbeijen
Copy link
Copy Markdown
Contributor

@mbeijen mbeijen commented Jun 4, 2026

The Digest auth challenge parser called a private unquote helper that index-errored on empty values, so a WWW-Authenticate header like Digest realm=, qop="auth", … would crash instead of being parsed as an empty realm. Switching to value.strip('"') (matching the pattern already used elsewhere for header parsing) fixes that, and also handles unbalanced or repeated quotes — see the rationale in encode/httpx#3771.

Port of encode/httpx#3771 by @JeroenVanZundert, with @akx's .strip('"') improvement applied.

Note: this change was prepared with AI assistance (Claude Code).

Drop the `unquote` helper in favour of `str.strip('"')`, matching the
style already used for header parsing. Port of encode/httpx#3771
(Jeroen van Zundert, with akx's improvement).

Co-Authored-By: Jeroen van Zundert <mail@jeroenvanzundert.nl>
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented Jun 4, 2026

Merging this PR will not alter performance

✅ 15 untouched benchmarks
⏩ 7 skipped benchmarks1


Comparing mbeijen:fix-unquote-empty-string (d11964a) with main (3146201)

Open in CodSpeed

Footnotes

  1. 7 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports.

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 3 files

Re-trigger cubic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant