elixir-mint / mint / 4385c9e2008166844824bb2e086231d6bafcfa6e

89%

push

github

Validate HTTP/2 response header fields and pseudo-headers (#504)

A :status value that isn't an integer, such as "abc" or "200 ", raised
ArgumentError from String.to_integer/1 inside stream/2, so a server could
crash the process streaming the response. Uppercase or otherwise invalid
field names, values containing NUL, CR or LF, undefined pseudo-headers,
duplicate :status fields, pseudo-headers after regular fields and
pseudo-headers in trailers were all delivered to the caller as if they
were regular headers.

Response header blocks are now checked against RFC 9113 8.2.1 and 8.3
before they're interpreted. A malformed block is a stream error: the
stream is reset with PROTOCOL_ERROR and the caller gets
{:invalid_status_header, value}, {:invalid_header_name, name},
{:invalid_header_value, name, value} or {:protocol_error, debug_data}.

A 1xx block after the final response is now reported as a pseudo-header
in trailers, which made the dedicated check for it unreachable.

33 of 33 new or added lines in 1 file covered. (100.0%)

1543 of 1741 relevant lines covered (88.63%)

556.28 hits per line