axum-extra-v0.12.6
wger-project/wgeraxum-extra-v0.12.6Apr 14, 2026by yanns
AI Summary
This release addresses a security vulnerability regarding header injection in Content-Disposition filenames, introduces strict validation for the vpath! macro syntax, and improves error handling for multipart body limits.
Key Highlights
- Escapes backslashes and double quotes in filenames to prevent header parameter injection.
- vpath! macro now stops compilation if using deprecated path variable formats (e.g., :var, *var), requiring {var} syntax.
- Returns specific error messages when multipart body limits are exceeded.
Breaking Changes
- The vpath! macro now enforces the new {var} syntax, rejecting deprecated formats like :var and *var.
Full Release Notes
- **fixed:** Escape backslashes and double quotes in `Content-Disposition` filenames to prevent header parameter injection in `Attachment` and `FileStream` ([#3664])
- `vpath!` macro now stops the compilation if your path is using deprecated path variables in the old `107` format, such as `:var` and `*var`. the only allowed way now is `{var}`. ([#3618])
- **fixed:** Return specific error message when multipart body limit is exceeded ([#3611])
[#3664]: https://github.com/tokio-rs/axum/pull/3664
[#3618]: https://github.com/tokio-rs/axum/pull/3618
[#3611]: https://github.com/tokio-rs/axum/pull/3611