The shared HTTP Link parser discards valid pagination links and corrupts quoted attributes. Callers in GitHub, GitLab, Netlify, Okta and Sentry access-review drivers depend on it. A provider response using these valid forms makes pagination stop early without an error. No claim is made that a particular hosted provider currently emits the example header.
At pkg/rfc5988/rfc5988.go:42:
Parse applies strings.SplitSeq(header, ",") before locating the angle-bracketed URI and then applies strings.SplitSeq(rest, ";") to all parameters at line 61. Neither split respects URI or quoted-string boundaries. With <https://api.example.com/items?cursor=a,b>; rel="next", the first part has no closing angle bracket and the second has no opening bracket, so both are discarded. With <https://api.example.com/items?page=2>; title="Page two, continued"; rel="next", the link survives but loses its rel parameter. FindByRel therefore returns an empty string. pkg/accessreview/drivers/gitlab.go:137 treats that result as successful end-of-pagination and returns records immediately. pkg/rfc5988/rfc5988_test.go covers simple multiple links and parameters but no embedded delimiters. Root cause: delimiter splitting happens before syntactic context is recognized.
Proposed fix
Replace the unconditional splits in pkg/rfc5988/rfc5988.go with a small scan that recognizes angle-bracketed targets and quoted parameter values, including escaped quotes. Split entries only at commas outside those constructs and split parameters only at unquoted semicolons. Preserve the existing exported types and caller behavior. Add focused table regressions in pkg/rfc5988/rfc5988_test.go for embedded commas, semicolons, escaped quotes and multiple actual entries. Do not expand this change into unrelated relation matching or driver refactors.
How to see it
Unambiguous source trace, not executed. Add table cases to TestParse for a comma in the URI target, a comma in a quoted title preceding rel, and title="Q1; Q2". Assert one intact Link, exact URL, exact title where present, and rel=next. Add corresponding TestFindByRel cases expecting the complete next URL. Current code returns no links for the comma-containing URI, an empty next URL for the quoted-comma case, and the truncated title Q1 for the quoted-semicolon case. The same fixtures must pass after context-aware tokenization. Retain existing multi-link tests to ensure actual entry separators still work.
If this looks right I can push fix/link-header-delimiter-parsing on anxkhn/probo instead of opening a pull request first.
The shared HTTP Link parser discards valid pagination links and corrupts quoted attributes. Callers in GitHub, GitLab, Netlify, Okta and Sentry access-review drivers depend on it. A provider response using these valid forms makes pagination stop early without an error. No claim is made that a particular hosted provider currently emits the example header.
At
pkg/rfc5988/rfc5988.go:42:Parse applies
strings.SplitSeq(header, ",")before locating the angle-bracketed URI and then appliesstrings.SplitSeq(rest, ";")to all parameters at line 61. Neither split respects URI or quoted-string boundaries. With<https://api.example.com/items?cursor=a,b>; rel="next", the first part has no closing angle bracket and the second has no opening bracket, so both are discarded. With<https://api.example.com/items?page=2>; title="Page two, continued"; rel="next", the link survives but loses its rel parameter. FindByRel therefore returns an empty string. pkg/accessreview/drivers/gitlab.go:137 treats that result as successful end-of-pagination and returns records immediately. pkg/rfc5988/rfc5988_test.go covers simple multiple links and parameters but no embedded delimiters. Root cause: delimiter splitting happens before syntactic context is recognized.Proposed fix
Replace the unconditional splits in pkg/rfc5988/rfc5988.go with a small scan that recognizes angle-bracketed targets and quoted parameter values, including escaped quotes. Split entries only at commas outside those constructs and split parameters only at unquoted semicolons. Preserve the existing exported types and caller behavior. Add focused table regressions in pkg/rfc5988/rfc5988_test.go for embedded commas, semicolons, escaped quotes and multiple actual entries. Do not expand this change into unrelated relation matching or driver refactors.
How to see it
Unambiguous source trace, not executed. Add table cases to TestParse for a comma in the URI target, a comma in a quoted title preceding rel, and title="Q1; Q2". Assert one intact Link, exact URL, exact title where present, and rel=next. Add corresponding TestFindByRel cases expecting the complete next URL. Current code returns no links for the comma-containing URI, an empty next URL for the quoted-comma case, and the truncated title Q1 for the quoted-semicolon case. The same fixtures must pass after context-aware tokenization. Retain existing multi-link tests to ensure actual entry separators still work.
If this looks right I can push
fix/link-header-delimiter-parsingonanxkhn/proboinstead of opening a pull request first.