arturobernalg opened a new pull request, #1154: URL: https://github.com/apache/tomcat/pull/1154
An application can set a response header field that cannot be sent in a valid HTTP/2 message. With the default ISO-8859-1 response encoding, a value that contains a character above 255 and is longer than five characters (so it is Huffman encoded) makes HPackHuffman.encode() throw while the header block is encoded. The client receives no HEADERS frame, an empty DATA frame with END_STREAM and a RST_STREAM with INTERNAL_ERROR, and curl (nghttp2) treats this as a connection error and drops the connection. A shorter value is truncated to one byte per character, so U+010A, U+0100 and U+010D are sent as LF, NUL and CR. NUL, CR, LF and leading or trailing whitespace in a value are also sent unchanged, which RFC 9113 section 8.2.1 does not permit. HTTP/1.1 already handles this. BZ 66196 removes a header field with a character that cannot be encoded and logs a warning, and control characters are replaced with a space. This change does the same for HTTP/2. The check is in Http2UpgradeHandler.doWriteHeaders(), so it covers the response, trailer fields and early hints. A header field with a name that is not a token, or a value with a character above 255, is removed and a warning is logged. Control characters in a value are replaced with a space and leading and trailing SP and HTAB are removed. TestHttp2Section_8_2_1 fails on main (the response has no HEADERS frame and ends with RST_STREAM) and passes with this change in both IO modes. It also checks that a second response on the same connection is correct. All 52 test classes in org.apache.coyote.http2 pass (7410 tests) and checkstyle passes. With a real server over h2c and curl, a request with such a header gives exit 16 and a new connection on main, and exit 0 with the header removed with this change. PR #277 covers the Connection header only. I did not find an existing PR or Bugzilla issue for the HTTP/2 case. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
