fix: content type parsing in httpx (#838)

.github/workflows/test.yml

@@ -59,7 +59,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v6
         with:
-          version: v1.61.0
+          version: v1.64.5
           args: --timeout 5m
       - name: Install cockroach DB
         run: |

.golangci.yml

@@ -4,6 +4,6 @@ linters:
     - govet
   disable-all: true
 
-run:
-  skip-files:
+issues:
+  exclude-files:
     - ".+_test.go"

Makefile

@@ -32,7 +32,7 @@ licenses: .bin/licenses node_modules  # checks open-source licenses
 	GOBIN=$(shell pwd)/.bin go install golang.org/x/tools/cmd/goimports@latest
 
 .bin/golangci-lint: Makefile
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b .bin v1.61.0
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b .bin v1.64.5
 
 .bin/licenses: Makefile
 	curl https://raw.githubusercontent.com/ory/ci/master/licenses/install | sh

httpx/content_type.go

@@ -6,9 +6,8 @@ package httpx
 import (
 	"mime"
 	"net/http"
+	"slices"
 	"strings"
-
-	"github.com/ory/x/stringslice"
 )
 
 // HasContentType determines whether the request `content-type` includes a
@@ -18,17 +17,15 @@ import (
 func HasContentType(r *http.Request, mimetypes ...string) bool {
 	contentType := r.Header.Get("Content-Type")
 	if contentType == "" {
-		return stringslice.Has(mimetypes, "application/octet-stream")
+		return slices.Contains(mimetypes, "application/octet-stream")
 	}
 
-	for _, v := range strings.Split(contentType, ",") {
-		t, _, err := mime.ParseMediaType(strings.TrimSpace(v))
-		if err != nil {
-			break
-		}
-		if stringslice.Has(mimetypes, t) {
-			return true
-		}
+	mediaType, _, err := mime.ParseMediaType(strings.TrimSpace(contentType))
+	if err != nil {
+		return false
+	}
+	if slices.Contains(mimetypes, mediaType) {
+		return true
 	}
 	return false
 }

httpx/content_type_test.go

@@ -14,8 +14,10 @@ func TestHasContentType(t *testing.T) {
 	assert.True(t, HasContentType(&http.Request{Header: map[string][]string{}}, "application/octet-stream"))
 	assert.False(t, HasContentType(&http.Request{Header: map[string][]string{}}, "not-application/octet-stream"))
 	assert.True(t, HasContentType(&http.Request{Header: map[string][]string{"Content-Type": {"application/octet-stream"}}}, "application/octet-stream"))
-	assert.True(t, HasContentType(&http.Request{Header: map[string][]string{"Content-Type": {"application/octet-stream, not-application/application"}}}, "not-application/application"))
-	assert.True(t, HasContentType(&http.Request{Header: map[string][]string{"Content-Type": {"application/octet-stream,not-application/application"}}}, "not-application/application"))
+
+	// Invalid conent types
+	assert.False(t, HasContentType(&http.Request{Header: map[string][]string{"Content-Type": {"application/octet-stream, not-application/application"}}}, "not-application/application"))
+	assert.False(t, HasContentType(&http.Request{Header: map[string][]string{"Content-Type": {"application/octet-stream,not-application/application"}}}, "not-application/application"))
 	assert.False(t, HasContentType(&http.Request{Header: map[string][]string{"Content-Type": {"application/octet-stream, application/not-application"}}}, "not-application/not-octet-stream"))
 	assert.False(t, HasContentType(&http.Request{Header: map[string][]string{"Content-Type": {"a"}}}, "not-application/not-octet-stream"))
 }