Decoy Contract sanitized

Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>

src/web/http/recovery.rs

@@ -30,9 +30,7 @@ pub(super) fn classify(request: &Request<RequestBody>) -> RootRepresentation {
     let first = values.next();
     let exact = first.is_some_and(|value| value.as_bytes() == MEDIA_TYPE.as_bytes())
         && values.next().is_none();
-    let recovery_present = accepts
-        .iter()
-        .any(|value| value.as_bytes() == MEDIA_TYPE.as_bytes());
+    let recovery_present = has_media_type(request);
     let authorization_present = request.headers().contains_key(header::AUTHORIZATION);
     if !exact {
         return if authorization_present || recovery_present {
@@ -52,6 +50,20 @@ pub(super) fn classify(request: &Request<RequestBody>) -> RootRepresentation {
         .unwrap_or(RootRepresentation::Invalid)
 }
 
+/// Detects a recovery media token even when its Accept syntax is noncanonical.
+pub(super) fn has_media_type(request: &Request<RequestBody>) -> bool {
+    request.headers().get_all(header::ACCEPT).iter().any(|value| {
+        value.to_str().ok().is_some_and(|value| {
+            value.split(',').any(|entry| {
+                entry
+                    .split(';')
+                    .next()
+                    .is_some_and(|media| media.trim().eq_ignore_ascii_case(MEDIA_TYPE))
+            })
+        })
+    })
+}
+
 /// Builds the bounded no-store recovery representation.
 pub(super) fn response(
     bootstrap: &BootstrapResult,

src/web/http/recovery_tests.rs

@@ -170,6 +170,26 @@ async fn malformed_or_over_capacity_recovery_is_indistinguishable_from_decoy() {
     assert_eq!(response_header(malformed_headers, "cache-control"), "no-store");
     assert_eq!(malformed_body, b"<!doctype html><title>decoy</title>");
 
+    let invalid_capability = recover(
+        &listener,
+        &runtime,
+        &base64::engine::general_purpose::URL_SAFE_NO_PAD.encode([99u8; 32]),
+        &format!("Bearer {}", "U".repeat(43)),
+    )
+    .await;
+    assert_eq!(invalid_capability, malformed);
+
+    let malformed_accept = request(
+        &listener,
+        &runtime,
+        format!(
+            "GET /?bridge={encoded} HTTP/1.1\r\nHost: proxy.example.com\r\nX-Forwarded-For: 192.0.2.40\r\nAccept: {RECOVERY_TYPE}, */*\r\nConnection: close\r\n\r\n"
+        )
+        .into_bytes(),
+    )
+    .await;
+    assert_eq!(malformed_accept, malformed);
+
     let _held = bridge_bootstrap(&listener, &runtime, &encoded).await;
     let over_capacity = recover(
         &listener,