{"record":{"id":"f86960fbefcf858e","repo":"quarkusio/quarkus","slug":"malformed-parameter","errorCode":null,"errorMessage":"Malformed parameter: ","messagePattern":"Malformed parameter: ","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"independent-projects/resteasy-reactive/server/runtime/src/main/java/org/jboss/resteasy/reactive/server/core/request/AcceptHeaders.java","lineNumber":52,"sourceCode":"        int offset = 0;\n        while (true) {\n            int endIndex = header.indexOf(',', offset);\n            String content;\n            if (endIndex < 0) {\n                content = header.substring(offset);\n            } else {\n                content = header.substring(offset, endIndex);\n            }\n\n            QualityValue qualityValue = QualityValue.DEFAULT;\n            int qualityIndex = content.indexOf(';');\n            if (qualityIndex >= 0) {\n                String parameter = content.substring(qualityIndex + 1);\n                content = content.substring(0, qualityIndex);\n\n                int equalsIndex = parameter.indexOf('=');\n                if (equalsIndex < 0) {\n                    throw new BadRequestException(\"Malformed parameter: \" + parameter);\n                }\n                String name = parameter.substring(0, equalsIndex).trim();\n                if (!\"q\".equals(name)) {\n                    throw new BadRequestException(\"Unsupported parameter: \" + parameter);\n                }\n                String value = parameter.substring(equalsIndex + 1).trim();\n                qualityValue = QualityValue.valueOf(value);\n            }\n\n            content = content.trim();\n            if (content.length() == 0) {\n                throw new BadRequestException(\"Empty Field in header: \" + header);\n            }\n            if (content.equals(\"*\")) {\n                result.put(null, qualityValue);\n            } else {\n                result.put(content, qualityValue);\n            }","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/independent-projects/resteasy-reactive/server/runtime/src/main/java/org/jboss/resteasy/reactive/server/core/request/AcceptHeaders.java#L34-L70","documentation":"AcceptHeaders.getStringQualityValues throws a BadRequestException while parsing an Accept-style header when a parameter segment lacks an '=' separator, e.g. Accept: text/html;q. Quality parameters must be name=value pairs (normally q=0.5). A malformed parameter causes the whole header parse to be rejected with 400.","triggerScenarios":"A client sends an Accept (or similar) header whose parameter after ';' has no '=' sign, e.g. \"text/html; q\" or \"application/json;q;level=1\".","commonSituations":"Hand-written or buggy client headers; broken interceptors/proxies rewriting headers; malformed Accept headers from custom HTTP clients or tests.","solutions":["Fix the client to send well-formed parameters: text/html;q=0.9 instead of text/html;q.","Strip or correct the malformed header in any proxy/middleware that rewrites it.","Reproduce with curl using a minimal valid header to confirm, then update the offending client code.","Server-side: catch BadRequestException via an exception mapper to return a clearer 400 message if you must tolerate bad clients."],"exampleFix":"// before\ncurl -H \"Accept: text/html;q\" ...\n// after\ncurl -H \"Accept: text/html;q=0.9\" ...","handlingStrategy":"try-catch","validationCode":"boolean wellFormed = header == null || Arrays.stream(header.split(\",\")).allMatch(p -> { int i = p.indexOf(';'); return i < 0 || Arrays.stream(p.substring(i+1).split(\";\")) .allMatch(kv -> kv.isBlank() || kv.contains(\"=\"))); });","typeGuard":null,"tryCatchPattern":"try { parseAccept(header); } catch (BadRequestException e) { log.warnf(\"bad header %s: %s\", header, e.getMessage()); return defaultQualityValues(); }","preventionTips":["Send name=value pairs after ';' in Accept headers","Test custom HTTP clients with a header linter","Check proxies/interceptors for header rewriting","Provide a clear 400 message via an exception mapper"],"tags":["http","headers","bad-request"],"backgroundTag":"malformed-accept-header","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}