Skip to content

improve list quote handling - #3128

Merged
davidism merged 2 commits into
stablefrom
parse-list
Mar 21, 2026
Merged

davidism merged 2 commits into
stablefrom
parse-list

Conversation

@davidism

Copy link
Copy Markdown
Member

parse_list_header is more accurate in how it parses quoted and empty items according to RFC 9110 https://httpwg.org/specs/rfc9110.html#abnf.extension. Previously it just wrapped urllib.request.parse_http_list, which was a bit too simple.

  • Empty parts are now discarded.
  • Backslash escapes are not unconditionally removed from quoted strings. unquote_header_value is used consistently for this purpose.
  • An unclosed quoted string is considered invalid and results in an empty list, rather than consuming the rest of the value. I considered raising a ValueError, but in general our parsing functions return empty values for invalid input.

@davidism davidism added this to the 3.1.7 milestone Mar 20, 2026
Comment thread src/werkzeug/http.py Resolved
Co-authored-by: Adrian <adrian@planetcoding.net>
@davidism
davidism merged commit 795f4ea into stable Mar 21, 2026
13 checks passed
@davidism
davidism deleted the parse-list branch March 21, 2026 02:52
@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Apr 5, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants