Opened 62 minutes ago
#37445 assigned Bug
Invalid Content-Type header (still) returns HTTP 500 instead of 400
| Reported by: | Oliver Haas | Owned by: | Oliver Haas |
|---|---|---|---|
| Component: | HTTP handling | Version: | 6.1 |
| Severity: | Normal | Keywords: | |
| Cc: | Triage Stage: | Unreviewed | |
| Has patch: | no | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | yes | UI/UX: | no |
Description
#36991 made HttpRequest._set_content_type_params() raise BadRequest for an invalid Content-Type header; before it was LookupError.
But according to the docs, the behavior and intention of the change was to my understanding to get a 400 response, but current main still responds with a 500, e.g. just with
curl -i -X POST http://127.0.0.1:8000/ -H "Content-Type: text/plain; charset*=BOGUS''%20"
This isn't really a regression, more like an incomplete fix.
Basically the exceptions are raised when the request is created and not inside the get_response(), so it slips by before the aptly named convert_exception_to_response() is used.
I'm intending to open a pull request shortly after this.
'Disclaimer'
I used Claude Code to investigate this bug. I saw this (super rare) error in our production env, probably coming from a security scanner. Mostly harmless, but also thought I could contribute here with a quick fix.