From 48de79ed57e9ef7b549ceabbb7bbf0ea0a287b66 Mon Sep 17 00:00:00 2001
From: Masaori Koshiba <masaori@apache.org>
Date: Mon, 14 Sep 2026 09:23:09 +0900
Subject: [PATCH 1/2] header_rewrite: guard the i == 0 case in
 HRWSimpleTokenizer

A value whose first character is '{' or '<' made the tokenizer read
line[-1], so whether the config loaded or was rejected with an opaque
"basic_string" error depended on the adjacent byte. Matches the guard
parse_line already uses for the same idiom.
---
 plugins/header_rewrite/header_rewrite_test.cc | 9 +++++++++
 plugins/header_rewrite/parser.cc              | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/plugins/header_rewrite/header_rewrite_test.cc b/plugins/header_rewrite/header_rewrite_test.cc
index 7ec83230a36..0b53fce5e68 100644
--- a/plugins/header_rewrite/header_rewrite_test.cc
+++ b/plugins/header_rewrite/header_rewrite_test.cc
@@ -557,6 +557,15 @@ test_tokenizer()
     END_TEST();
   }
 
+  {
+    SimpleTokenizerTest p("{a}%{PATH}");
+    CHECK_EQ(p.get_tokens().size(), 2UL);
+    CHECK_EQ(p.get_tokens()[0], "{a}");
+    CHECK_EQ(p.get_tokens()[1], "%{PATH}");
+
+    END_TEST();
+  }
+
   return errors;
 }
 
diff --git a/plugins/header_rewrite/parser.cc b/plugins/header_rewrite/parser.cc
index c1f467d39a8..ed3a7e27da1 100644
--- a/plugins/header_rewrite/parser.cc
+++ b/plugins/header_rewrite/parser.cc
@@ -344,7 +344,7 @@ HRWSimpleTokenizer::HRWSimpleTokenizer(const std::string &line)
     switch (state) {
     case PARSER_DEFAULT:
       if ((line[i] == '{') || (line[i] == '<')) {
-        if (line[i - 1] == '%') {
+        if (i > 0 && line[i - 1] == '%') {
           // pickup what we currently have
           cur_token_length = i - cur_token_start - 1;
           if (cur_token_length > 0) {

From 6207478ae1fc825bf44acbf95dec93fc11aba819 Mon Sep 17 00:00:00 2001
From: Masaori Koshiba <masaori@apache.org>
Date: Mon, 14 Sep 2026 10:06:55 +0900
Subject: [PATCH 2/2] header_rewrite: cover the '<' form of the leading-brace
 tokenizer case

The i == 0 guard protects both '{' and '<', but only the '{' form was
exercised.
---
 plugins/header_rewrite/header_rewrite_test.cc | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/plugins/header_rewrite/header_rewrite_test.cc b/plugins/header_rewrite/header_rewrite_test.cc
index 0b53fce5e68..36702c1761f 100644
--- a/plugins/header_rewrite/header_rewrite_test.cc
+++ b/plugins/header_rewrite/header_rewrite_test.cc
@@ -566,6 +566,15 @@ test_tokenizer()
     END_TEST();
   }
 
+  {
+    SimpleTokenizerTest p("<a>%{PATH}");
+    CHECK_EQ(p.get_tokens().size(), 2UL);
+    CHECK_EQ(p.get_tokens()[0], "<a>");
+    CHECK_EQ(p.get_tokens()[1], "%{PATH}");
+
+    END_TEST();
+  }
+
   return errors;
 }