httptransport: Check MediaType can be split on /

It is possible for a client to manifest a panic by sending invalid Accept header. Signed-off-by: crozzy <[email protected]>
quay · Dec 8, 2023 · b57e664 · b57e664
1 parent 0be08ec
commit b57e664
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/httptransport/common.go b/httptransport/common.go
@@ -67,6 +67,9 @@ func pickContentType(w http.ResponseWriter, r *http.Request, allow []string) err
 				a.Q, _ = strconv.ParseFloat(qs, 64)
 			}
 			typ := strings.Split(mt, "/")
+			if len(typ) != 2 {
+				return fmt.Errorf("malformed Accept value %s", mt)
+			}
 			a.Type = typ[0]
 			a.Subtype = typ[1]
 			acceptable = append(acceptable, a)