{"record":{"id":"78973844be9a9d24","repo":"cloudflare/quiche","slug":"malformed-header-provided-header","errorCode":null,"errorMessage":"malformed header provided - \"{header}\"","messagePattern":"malformed header provided - \"(.+?)\"","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"apps/src/common.rs","lineNumber":814,"sourceCode":"                        b\":path\",\n                        url[url::Position::BeforePath..].as_bytes(),\n                    ),\n                    quiche::h3::Header::new(b\"user-agent\", b\"quiche\"),\n                ];\n\n                let priority = if send_priority_update {\n                    priority_from_query_string(url)\n                } else {\n                    None\n                };\n\n                // Add custom headers to the request.\n                for header in req_headers {\n                    let header_split: Vec<&str> =\n                        header.splitn(2, \": \").collect();\n\n                    if header_split.len() != 2 {\n                        panic!(\"malformed header provided - \\\"{header}\\\"\");\n                    }\n\n                    hdrs.push(quiche::h3::Header::new(\n                        header_split[0].as_bytes(),\n                        header_split[1].as_bytes(),\n                    ));\n                }\n\n                if body.is_some() {\n                    hdrs.push(quiche::h3::Header::new(\n                        b\"content-length\",\n                        body.as_ref().unwrap().len().to_string().as_bytes(),\n                    ));\n                }\n\n                reqs.push(Http3Request {\n                    url: url.clone(),\n                    cardinal: i,","sourceCodeStart":796,"sourceCodeEnd":832,"githubUrl":"https://github.com/cloudflare/quiche/blob/9f96daa2c22a4468b0036fb0a0a3894eee6498b8/apps/src/common.rs#L796-L832","documentation":"with_urls parses custom request headers supplied as 'Name: value' strings, splitting on the first ': '. If a header string does not contain that separator exactly (splitn yields != 2 parts), the CLI panics. It is strict input validation of user-provided header text.","triggerScenarios":"Passing --header values without the ': ' separator, e.g. 'Authorization=Bearer x', 'Host:example.com' (colon without following space), or an empty/whitespace header.","commonSituations":"Copy-pasting headers that use 'name:value' without a space, using '=' instead of ':', or forgetting the value entirely.","solutions":["Format each header as 'Name: value' with a colon and a space after the name.","Quote the header argument in your shell so spaces survive.","Verify no leading/trailing whitespace corrupts the separator."],"exampleFix":"// before\n--header 'Host:example.com'\n// after\n--header 'Host: example.com'","handlingStrategy":"validation","validationCode":"fn valid_header(h: &str) -> bool {\n    match h.split_once(\": \") { Some((k, v)) => !k.is_empty() && !v.is_empty(), None => false }\n}\nassert!(req_headers.iter().all(|h| valid_header(h)), \"headers must be 'Name: value'\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always format CLI headers as 'Name: value' with colon+space.","Quote header arguments in shell scripts.","Lint your test scripts for header format before running."],"tags":["cli","http-headers","input-validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"9f96daa2c22a4468b0036fb0a0a3894eee6498b8","analyzedAt":"2026-09-08T11:27:09.536Z","contentChangedAt":"2026-09-08T11:27:09.536Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}