{"record":{"id":"c2ca1f180b4194bd","repo":"bevyengine/bevy","slug":"invalid-header-value","errorCode":null,"errorMessage":"Invalid header value","messagePattern":"Invalid header value","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/bevy_remote/src/http.rs","lineNumber":90,"sourceCode":"impl Headers {\n    /// Create a new instance of `Headers`.\n    pub fn new() -> Self {\n        Self {\n            headers: HashMap::default(),\n        }\n    }\n\n    /// Insert a key value pair to the `Headers` instance.\n    pub fn insert(\n        mut self,\n        name: impl TryInto<HeaderName>,\n        value: impl TryInto<HeaderValue>,\n    ) -> Self {\n        let Ok(header_name) = name.try_into() else {\n            panic!(\"Invalid header name\")\n        };\n        let Ok(header_value) = value.try_into() else {\n            panic!(\"Invalid header value\")\n        };\n        self.headers.insert(header_name, header_value);\n        self\n    }\n}\n\nimpl Default for Headers {\n    fn default() -> Self {\n        Self::new()\n    }\n}\n\n/// Add this plugin to your [`App`] to allow remote connections over HTTP to inspect and modify entities.\n/// It requires the [`RemotePlugin`](super::RemotePlugin).\n///\n/// This BRP transport cannot be used when targeting WASM.\n///\n/// The defaults are:","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/bevyengine/bevy/blob/396ca727080776bd313bb892423b7d94e03b81b4/crates/bevy_remote/src/http.rs#L72-L108","documentation":"The value-side counterpart of the header-name panic in `Headers::insert` (bevy_remote's HTTP transport for BRP): `insert` converts the value into `hyper`'s `HeaderValue` and panics when the conversion fails. String values must be visible ASCII; control characters and non-ASCII bytes are rejected.","triggerScenarios":"Calling `headers.insert(name, value)` with a `&str`/`String` value containing control characters (newline, tab-adjacent control bytes, NUL) or non-ASCII characters, e.g. a value built from unescaped multi-line user input.","commonSituations":"Forwarding user text or JSON blobs into response headers without sanitizing; embedding `\\n` in values copied from configuration files; non-UTF8-ASCII locale characters in values.","solutions":["Sanitize the value before inserting: strip or replace newlines and control bytes","For binary values, encode them (Base64) or use `HeaderValue::from_bytes` on your side to validate first","Keep values to visible ASCII (0x20..0x7E) when building Headers for bevy_remote"],"exampleFix":"// before\nlet headers = Headers::new().insert(\"X-Custom\", format!(\"a\\nb\"));\n\n// after\nlet headers = Headers::new().insert(\"X-Custom\", \"a b\");","handlingStrategy":"validation","validationCode":"fn valid_header_value(value: &str) -> bool {\n    hyper::header::HeaderValue::from_str(value).is_ok()\n}\n\nlet sanitized = value.replace(['\\n', '\\r'], \" \");\nif valid_header_value(&sanitized) {\n    headers = headers.insert(name, sanitized);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip newlines/control bytes from any value built from user input","Base64-encode binary payloads instead of putting raw bytes in headers","Validate with HeaderValue::from_str before calling Headers::insert"],"tags":["bevy","bevy-remote","brp","http","headers","panic"],"backgroundTag":"invalid-http-header","analyzedSha":"396ca727080776bd313bb892423b7d94e03b81b4","analyzedAt":"2026-08-20T16:12:39.808Z","contentChangedAt":"2026-08-20T16:12:39.808Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}