Regression in 1.10.18: invalid header key or value

[Octogonapus]

HTTP.jl v1.10.18 added some header validation that's erroring when passing AWS authorization keys. I can't paste the full header content, but this is the sort of header that errors:

# key
Authorization

# value
AWS4-HMAC-SHA256 Credential=REDACTED/20251003/us-east-2/secretsmanager/aws4_request, SignedHeaders=content-md5;content-type;host;user-agent;x-amz-content-sha256;x-amz-date;x-amz-target, Signature=REDACTED

Full error:

julia> Secrets_Manager.get_secret_value("arn:aws:secretsmanager:us-east-2:redacted:secret:test-secret-yhl8wa", Dict("VersionId" => "redacted"))
ERROR: ArgumentError: Invalid header key or value
Stacktrace:
  [1] mkheaders(h::OrderedCollections.LittleDict{String, String, Vector{String}, Vector{String}}, headers::Vector{Pair{SubString{String}, SubString{String}}})
    @ HTTP.Messages ~/.julia/packages/HTTP/0urVx/src/Messages.jl:215
  [2] mkheaders(h::OrderedCollections.LittleDict{String, String, Vector{String}, Vector{String}})
    @ HTTP.Messages ~/.julia/packages/HTTP/0urVx/src/Messages.jl:209
  [3] macro expansion
    @ ~/.julia/packages/Mocking/eug7a/src/mock.jl:52 [inlined]
  [4] (::AWS.var"#48#50"{Request, OrderedCollections.LittleDict{Symbol, Any, Vector{Symbol}, Vector{Any}}})()
    @ AWS ~/.julia/packages/AWS/ZEOyZ/src/utilities/request.jl:222
  [5] (::Base.var"#106#108"{Base.var"#106#107#109"{AWS.AWSExponentialBackoff, AWS.var"#49#51", AWS.var"#48#50"{Request, OrderedCollections.LittleDict{Symbol, Any, Vector{Symbol}, Vector{Any}}}}})(; kwargs::@Kwargs{})
    @ Base ./error.jl:300
  [6] (::Base.var"#106#108"{Base.var"#106#107#109"{AWS.AWSExponentialBackoff, AWS.var"#49#51", AWS.var"#48#50"{Request, OrderedCollections.LittleDict{Symbol, Any, Vector{Symbol}, Vector{Any}}}}})()
    @ Base ./error.jl:295
  [7] _http_request(http_backend::AWS.HTTPBackend, request::Request, response_stream::IOBuffer)
    @ AWS ~/.julia/packages/AWS/ZEOyZ/src/utilities/request.jl:247
  [8] macro expansion
    @ ~/.julia/packages/Mocking/eug7a/src/mock.jl:52 [inlined]
  [9] (::AWS.var"#41#44"{AWSConfig, Request, IOBuffer, Vector{Int64}})()
    @ AWS ~/.julia/packages/AWS/ZEOyZ/src/utilities/request.jl:131
 [10] (::AWS.var"#42#46"{AWS.var"#41#44"{AWSConfig, Request, IOBuffer, Vector{Int64}}, IOBuffer})()
    @ AWS ~/.julia/packages/AWS/ZEOyZ/src/utilities/request.jl:146
 [11] (::Base.var"#106#108"{Base.var"#106#107#109"{AWS.AWSExponentialBackoff, AWS.var"#43#47"{AWSConfig, Vector{String}, Vector{String}, Int64}, AWS.var"#42#46"{AWS.var"#41#44"{AWSConfig, Request, IOBuffer, Vector{Int64}}, IOBuffer}}})(; kwargs::@Kwargs{})
    @ Base ./error.jl:300
 [12] (::Base.var"#106#108"{Base.var"#106#107#109"{AWS.AWSExponentialBackoff, AWS.var"#43#47"{AWSConfig, Vector{String}, Vector{String}, Int64}, AWS.var"#42#46"{AWS.var"#41#44"{AWSConfig, Request, IOBuffer, Vector{Int64}}, IOBuffer}}})()
    @ Base ./error.jl:295
 [13] submit_request(aws::AWSConfig, request::Request; return_headers::Nothing)
    @ AWS ~/.julia/packages/AWS/ZEOyZ/src/utilities/request.jl:197
 [14] (::JSONService)(operation::String, args::Dict{String, Any}; aws_config::AWSConfig, feature_set::AWS.FeatureSet)
    @ AWS ~/.julia/packages/AWS/ZEOyZ/src/AWS.jl:444
 [15] JSONService
    @ ~/.julia/packages/AWS/ZEOyZ/src/AWS.jl:421 [inlined]
 [16] get_secret_value(SecretId::String, params::Dict{String, String}; aws_config::AWSConfig)
    @ Main.Secrets_Manager ~/.julia/packages/AWS/ZEOyZ/src/services/secrets_manager.jl:527
 [17] get_secret_value(SecretId::String, params::Dict{String, String})
    @ Main.Secrets_Manager ~/.julia/packages/AWS/ZEOyZ/src/services/secrets_manager.jl:522
 [18] top-level scope
    @ REPL[4]:1

[justinmimbs]

We also just encountered this regression. The new header validation doesn't allow spaces in header values, but space and tab characters should be allowed.

Minimal reproducer:

julia> HTTP.get("http://localhost:3000"; headers = ["x" => "a b"])
ERROR: ArgumentError: Invalid header key or value

[omus]

The 1.10.18 release doesn't even pass its own tests. It's odd this commit was added without a PR and without waiting on the tests: 3e932f6

[maganaluis]

The release 1.10.18 needs to be yanked out, without clear release notes or a PR description there is no way of providing a fix without knowing what this change was intended to address.

[quinnj]

My mistake everyone. This commit was merged as a fix for a security advisory which was a temporary private fork where CI isn't able to run. I merged after manually reviewing, without really thinking and immediately made a new release. I put too much trust in the original author of the commit (don't need to publicly disclose) and too much weight on getting the security advisory fix out without having properly reviewed/tested things. #1236 should fix the overly aggressive check while maintaining a fix for the lax of allowing control characters in header keys.