{"record":{"id":"4eb78570a9fbd862","repo":"quarkusio/quarkus","slug":"unclosed-quotes","errorCode":null,"errorMessage":"Unclosed quotes:","messagePattern":"Unclosed quotes:","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"independent-projects/resteasy-reactive/server/runtime/src/main/java/org/jboss/resteasy/reactive/server/core/request/AcceptHeaders.java","lineNumber":179,"sourceCode":"\n        //LogMessages.LOGGER.debug(result.toString());\n        return result;\n    }\n\n    private static int parseParameters(Map<String, String> parameters, String header, int offset) {\n        while (true) {\n            int equalsIndex = header.indexOf('=', offset);\n            if (equalsIndex < 0)\n                throw new BadRequestException(\"Malformed parameters: \" + header);\n            String name = header.substring(offset, equalsIndex).trim();\n            offset = equalsIndex + 1;\n            if (header.charAt(offset) == '\"') {\n                int end = offset;\n                ++offset;\n                do {\n                    end = header.indexOf('\"', ++end);\n                    if (end < 0)\n                        throw new BadRequestException(\"Unclosed quotes:\" + header);\n                } while (header.charAt(end - 1) == '\\\\');\n                String value = header.substring(offset, end);\n                parameters.put(name, value);\n                offset = end + 1;\n\n                int parameterEndIndex = header.indexOf(';', offset);\n                int itemEndIndex = header.indexOf(',', offset);\n                if (parameterEndIndex == itemEndIndex) {\n                    assert itemEndIndex == -1;\n                    if (header.substring(offset).trim().length() != 0)\n                        throw new BadRequestException(\"Extra characters after quoted string:\" + header);\n                    return -1;\n                } else if (parameterEndIndex < 0 || (itemEndIndex >= 0 && itemEndIndex < parameterEndIndex)) {\n                    if (header.substring(offset, itemEndIndex).trim().length() != 0)\n                        throw new BadRequestException(\"Extra characters after quoted string:\" + header);\n                    return itemEndIndex + 1;\n                } else {\n                    if (header.substring(offset, parameterEndIndex).trim().length() != 0)","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/independent-projects/resteasy-reactive/server/runtime/src/main/java/org/jboss/resteasy/reactive/server/core/request/AcceptHeaders.java#L161-L197","documentation":"When a parameter value starts with a quote, parseParameters() scans for the closing quote, allowing escaped quotes (\\\". If no unescaped closing quote exists in the header, this BadRequestException is thrown.","triggerScenarios":"Accept header with an unbalanced quoted parameter, e.g. 'application/json;x=\"foo' — the opening quote is never closed.","commonSituations":"Programmatic header construction with unescaped quotes; values containing quotes intended as literals; copy-paste of header examples missing the closing quote.","solutions":["Close the quoted parameter value with a matching '\"'","Escape embedded quotes as \\\" inside quoted values","Avoid quotes for simple parameter values (e.g. charset=utf-8 needs none)"],"exampleFix":"// before\nAccept: application/json;x=\"foo\n// after\nAccept: application/json;x=\"foo\\\"bar\" or Accept: application/json;x=foo","handlingStrategy":"validation","validationCode":"boolean quotesAreBalanced(String header) {\n    if (header == null) return false;\n    long count = header.chars().filter(c -> c == '\"').count();\n    return count % 2 == 0;\n}","typeGuard":"boolean hasBalancedQuotes(String header) {\n    return header == null || header.replaceAll(\"\\\\\\\\\\\"\", \"\").chars()\n        .filter(c -> c == '\"').count() % 2 == 0;\n}","tryCatchPattern":"try {\n    types = AcceptHeaders.getMediaTypeQualityValues(accept);\n} catch (BadRequestException e) {\n    types = Collections.emptyMap();\n}","preventionTips":["Escape embedded quotes as \\\" inside quoted parameter values","Prefer unquoted simple parameter values","Escape quotes before serializing user input into header parameters"],"tags":["http","header-parsing","quoting"],"backgroundTag":"malformed-http-header","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}