id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
36833	HttpRequest.accepted_types incorrectly splits Accept header on commas inside quoted parameter values	Naveed Qadir	Naveed Qadir	"The `accepted_types` property in `HttpRequest` uses `str.split("","")` to parse the Accept header, which incorrectly splits on commas that appear inside quoted parameter values.

== Example ==

{{{#!python
# Accept header with quoted parameter containing comma
header = 'text/plain; param=""a,b"", application/json'

# Current behavior (WRONG):
header.split("","")
# Returns: ['text/plain; param=""a', 'b""', ' application/json']
# 3 parts - comma inside quotes was incorrectly treated as separator

# Expected behavior (per RFC 7231):
# Should return 2 media types:
# 1. text/plain; param=""a,b""
# 2. application/json
}}}

== RFC Reference ==

RFC 7231 Section 5.3.2 specifies that media-type parameters can contain quoted-string values, and RFC 7230 Section 3.2.6 allows commas within quoted strings.

== Proposed Fix ==

Add a `split_header_words()` helper function to `django/utils/http.py` that splits on commas while respecting quoted strings, similar to how `_parseparam()` handles semicolons.

A patch with tests is available."	Bug	closed	HTTP handling	dev	Normal	needsinfo	HTTP_ACCEPT, accept	Naveed Qadir	Unreviewed	1	0	0	0	0	0