BUG/MEDIUM: configuration: reject unquoted multi-word return content

An http-request/http-response deny or return rule (and an http-error
status rule) whose return content contains spaces but is not quoted,
e.g. content "Missing Auth", was serialized verbatim into an invalid
config line:

    http-request deny content-type text/html string Missing Auth

The structured API reported success because the in-memory rule reads
back correctly within the same request. On the next config reload the
line fails to parse (the orphan token trips the action parser), and the
reader silently skips lines that fail to parse, so the rule was dropped
without any error being surfaced to the caller.

Validate the return content when serializing the rule and reject a value
that does not tokenize back to a single token: multi-word values must be
quoted by the caller, matching how the raw configuration endpoint
already rejects them. The check mirrors the serializer's emit condition
(content is only written when both content and format are non-empty and
the format is not default-errorfiles), so content that is never written
is left untouched.

Author: aiharos

configuration/http_error_rule.go

@@ -317,6 +317,9 @@ func SerializeHTTPErrorRule(f models.HTTPErrorRule) (types.Action, error) { //no
 	if f.Type != "status" {
 		return nil, NewConfError(ErrValidationError, fmt.Sprintf("unsupported action %s in http_error", f.Type))
 	}
+	if err := validateReturnContent(f.ReturnContentFormat, f.ReturnContent); err != nil {
+		return nil, err
+	}
 
 	contentType := ""
 	if f.ReturnContentType != nil {

configuration/http_request_rule.go

@@ -983,6 +983,9 @@ func SerializeHTTPRequestRule(f models.HTTPRequestRule, opt *options.Configurati
 			Comment:  comment,
 		}
 	case "deny":
+		if err := validateReturnContent(f.ReturnContentFormat, f.ReturnContent); err != nil {
+			return nil, err
+		}
 		contentType := ""
 		if f.ReturnContentType != nil {
 			contentType = *f.ReturnContentType
@@ -1113,6 +1116,9 @@ func SerializeHTTPRequestRule(f models.HTTPRequestRule, opt *options.Configurati
 			Comment:    comment,
 		}
 	case "return":
+		if err := validateReturnContent(f.ReturnContentFormat, f.ReturnContent); err != nil {
+			return nil, err
+		}
 		contentType := ""
 		if f.ReturnContentType != nil {
 			contentType = *f.ReturnContentType

configuration/http_response_rule.go

@@ -729,6 +729,9 @@ func SerializeHTTPResponseRule(f models.HTTPResponseRule, opt *options.Configura
 			Comment:  comment,
 		}
 	case "deny":
+		if err := validateReturnContent(f.ReturnContentFormat, f.ReturnContent); err != nil {
+			return nil, err
+		}
 		contentType := ""
 		if f.ReturnContentType != nil {
 			contentType = *f.ReturnContentType
@@ -796,6 +799,9 @@ func SerializeHTTPResponseRule(f models.HTTPResponseRule, opt *options.Configura
 			Comment:    comment,
 		}
 	case "return":
+		if err := validateReturnContent(f.ReturnContentFormat, f.ReturnContent); err != nil {
+			return nil, err
+		}
 		contentType := ""
 		if f.ReturnContentType != nil {
 			contentType = *f.ReturnContentType

configuration/misc.go

@@ -1,6 +1,9 @@
 package configuration
 
 import (
+	"fmt"
+
+	"github.com/haproxytech/client-native/v6/config-parser/common"
 	"github.com/haproxytech/client-native/v6/config-parser/parsers/http/actions"
 
 	"github.com/haproxytech/client-native/v6/models"
@@ -21,6 +24,30 @@ func actionHdr2ModelHdr(hdrs []*actions.Hdr) []*models.ReturnHeader {
 	return headers
 }
 
+// validateReturnContent ensures a return-content value can be faithfully
+// persisted. The value is emitted verbatim after the content-format keyword
+// (string/lf-string/file/lf-file/errorfile), and HAProxy treats it as a single
+// token: multi-word values must be quoted by the caller. When they are not, the
+// serialized line (e.g. `... string Missing Auth`) fails to parse and is
+// silently dropped on the next config reload, even though the transaction
+// reports success. Reject such values here instead so the caller gets an error.
+//
+// The check mirrors the serializer's emit condition: content is only written
+// when both the content and the format are non-empty and the format is not
+// default-errorfiles, so anything that is not actually emitted cannot break the
+// round-trip and is left alone.
+func validateReturnContent(format, content string) error {
+	if content == "" || format == "" || format == "default-errorfiles" {
+		return nil
+	}
+	tokens, comment := common.StringSplitWithCommentIgnoreEmpty(content)
+	if comment != "" || len(tokens) != 1 || tokens[0] != content {
+		return NewConfError(ErrValidationError,
+			fmt.Sprintf("invalid return content %q: multi-word values must be quoted", content))
+	}
+	return nil
+}
+
 func modelHdr2ActionHdr(hdrs []*models.ReturnHeader) []*actions.Hdr {
 	if len(hdrs) == 0 {
 		return nil

test/http_request_rule_return_content_test.go

@@ -0,0 +1,113 @@
+// Copyright 2026 HAProxy Technologies
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package test
+
+import (
+	"testing"
+
+	"github.com/haproxytech/client-native/v6/configuration"
+	"github.com/haproxytech/client-native/v6/configuration/options"
+	"github.com/haproxytech/client-native/v6/misc"
+	"github.com/haproxytech/client-native/v6/models"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSerializeReturnContentValidation guards against the silent-drop bug where
+// an unquoted multi-word return content serializes to an invalid HAProxy config
+// line (e.g. `... string Missing Auth`) that fails to parse and is silently
+// dropped on the next config reload, while the API reports success.
+//
+// It covers all serialize sites that emit return content: http-request and
+// http-response deny/return, and http-error status.
+func TestSerializeReturnContentValidation(t *testing.T) {
+	opt := &options.ConfigurationOptions{}
+
+	cases := []struct {
+		name    string
+		format  string
+		content string
+		wantErr bool
+	}{
+		{"unquoted_multiword", "string", "Missing Auth", true},
+		{"quoted_multiword", "string", `"Missing Auth"`, false},
+		{"escaped_space", "string", `Missing\ Auth`, false},
+		{"single_word", "string", "MissingAuth", false},
+		{"empty_content", "string", "", false},
+		// Content is never emitted when the format is empty or default-errorfiles,
+		// so it cannot break the round-trip and must not be rejected.
+		{"empty_format_multiword", "", "Missing Auth", false},
+		{"default_errorfiles_multiword", "default-errorfiles", "Missing Auth", false},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			// http-request deny
+			_, err := configuration.SerializeHTTPRequestRule(models.HTTPRequestRule{
+				Type:                "deny",
+				ReturnContentType:   misc.Ptr("text/html"),
+				ReturnContentFormat: tc.format,
+				ReturnContent:       tc.content,
+			}, opt)
+			assertContentErr(t, "http-request deny", tc.wantErr, err)
+
+			// http-request return
+			_, err = configuration.SerializeHTTPRequestRule(models.HTTPRequestRule{
+				Type:                "return",
+				ReturnContentType:   misc.Ptr("text/html"),
+				ReturnContentFormat: tc.format,
+				ReturnContent:       tc.content,
+			}, opt)
+			assertContentErr(t, "http-request return", tc.wantErr, err)
+
+			// http-response deny
+			_, err = configuration.SerializeHTTPResponseRule(models.HTTPResponseRule{
+				Type:                "deny",
+				ReturnContentType:   misc.Ptr("text/html"),
+				ReturnContentFormat: tc.format,
+				ReturnContent:       tc.content,
+			}, opt)
+			assertContentErr(t, "http-response deny", tc.wantErr, err)
+
+			// http-response return
+			_, err = configuration.SerializeHTTPResponseRule(models.HTTPResponseRule{
+				Type:                "return",
+				ReturnContentType:   misc.Ptr("text/html"),
+				ReturnContentFormat: tc.format,
+				ReturnContent:       tc.content,
+			}, opt)
+			assertContentErr(t, "http-response return", tc.wantErr, err)
+
+			// http-error status (403 is a valid error status code)
+			_, err = configuration.SerializeHTTPErrorRule(models.HTTPErrorRule{
+				Type:                "status",
+				Status:              403,
+				ReturnContentType:   misc.Ptr("text/html"),
+				ReturnContentFormat: tc.format,
+				ReturnContent:       tc.content,
+			})
+			assertContentErr(t, "http-error status", tc.wantErr, err)
+		})
+	}
+}
+
+func assertContentErr(t *testing.T, site string, wantErr bool, err error) {
+	t.Helper()
+	if wantErr {
+		require.Error(t, err, "%s: value should be rejected, not silently dropped", site)
+	} else {
+		require.NoError(t, err, "%s: value should be accepted", site)
+	}
+}