mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-09-03 07:13:48 +00:00
e96a52e9dd
parse_accept_header() rejected any Accept value with a leading, trailing or doubled comma, and Server::process_request() validates Accept before routing, so "Accept: text/html," was answered 400 Bad Request on every route. RFC 9110 Section 5.6.1.2 requires a recipient to parse and ignore empty list elements in a #rule list, so those values are legal. split() already trims each element and skips the empty ones, which made the guard inside the callback unreachable as well; drop both and let the empty elements fall away. The header length limit bounds how many a sender can send, so ignoring all of them cannot be used as a denial-of-service vector. get_combined_header_value() keeps skipping empty field lines, but that skip is no longer observable through a request now that a stray comma parses cleanly, so it gets its own test.
