Skip to content

fix(openapi_fdw): respect quoted strings and escapes in Link header - #626

Open
Vishv07 wants to merge 1 commit into
supabase:mainfrom
Vishv07:fix-link-header-param-parsing
Open

fix(openapi_fdw): respect quoted strings and escapes in Link header#626
Vishv07 wants to merge 1 commit into
supabase:mainfrom
Vishv07:fix-link-header-param-parsing

Conversation

@Vishv07

@Vishv07 Vishv07 commented Aug 15, 2026

Copy link
Copy Markdown

Summary

Fixes an RFC 8288 parameter parsing bug in openapi_fdw/src/response.rs where a semicolon inside a quoted parameter value (such as title="item;rel=next") was treated as a top-level parameter delimiter, causing has_rel_next() to falsely identify the link entry as having rel="next".


Problem

In split_link_entries(), entries are split on commas while carefully respecting quoted strings and RFC 7230 backslash escapes (\").

However, has_rel_next() previously split parameters using a plain params.split(';'). When a quoted parameter contained a semicolon and the substring
rel=next (e.g. <https://api.example.com/items>; title="page;rel=next"; rel="last"):

  1. split(';') split the parameter into fragments title="page and rel=next".
  2. split_once('=') matched name="rel", and trim_matches('"') produced value="next".
  3. has_rel_next() returned true, incorrectly treating a rel="last" URL as the next pagination page.

Solution

  • Added split_link_params(), which splits parameter lists on top-level semicolons while honoring quoted strings and RFC 7230 quoted-pair backslash escapes
    (mirroring the entry splitting behavior in split_link_entries()).
  • Updated has_rel_next() to iterate over split_link_params(params) instead of params.split(';').
  • Added unit regression tests in response_tests.rs covering:
    • Quoted semicolons in non-rel parameters (e.g. title="a;rel=next"; rel="last" returning None).
    • Quoted semicolons with valid rel="next" parameters present.
    • Backslash-escaped quotes inside parameters (e.g. title="item \"foo;bar\""; rel="next").

Verification

  • Regression test reproduces the failure on main and passes with this fix.
  • Full make check suite in wasm-wrappers/fdw/openapi_fdw passes cleanly:
    • cargo fmt clean
    • cargo clippy --all --tests --no-deps with 0 warnings
    • All 566 unit tests passing
    • cargo component build --release --target wasm32-unknown-unknown succeeds

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant