elixir-mint / mint / 75d7f7dbf08d386c1ac505ea9907067224f1c245-PR-545

91%

main: 90%

Build Type

Pull #545

github

Committed by bmalum

Commit Message

Validate HTTP/2 request methods, targets and header fields

Mint.HTTP2.request/5 lowercased the header names it was given and
HPACK-encoded everything else as is, and stream_request_body/3 did the
same for trailers. A method, :path, CONNECT target, header name or
header value containing CR, LF or NUL, a header name containing a space
or a colon, or a value with leading or trailing whitespace was sent to
the server unchanged. Mint.HTTP1 rejects all of these, and Mint.HTTP2
rejects them in responses since #504, so the behaviour of a request
depended on which protocol ALPN negotiated.

RFC 9113 8.2.1 forbids these characters in field names and values and
says a sender must not generate such a message. HTTP/2 framing isn't
confused by them, but an intermediary that forwards the request over
HTTP/1.1 without re-validating the fields turns an injected CRLF into
request header injection or request splitting on its back-end
connection, so an application that is safe against an HTTP/1 origin
isn't once the origin or a CDN in front of it enables HTTP/2.

Requests and trailers are now validated before a stream is opened, with
the field rules already used for responses: the method must be a token
(RFC 9110 9.1), :path and the CONNECT :authority must be non-empty
field values (RFC 9113 8.3.1), pseudo-header names passed by the caller
must be valid field names, and trailers can't carry pseudo-headers (RFC
9113 8.1). Invalid input fails with :invalid_request_method,
:invalid_request_target, :invalid_header_name or :invalid_header_value,
like in Mint.HTTP1, and the connection stays open without the request
taking up a stream. The messages for the two header errors no longer
mention the response, since they now apply to requests as well.

Pull Request Pull Request #545: Validate HTTP/2 request methods, targets and header fields

Coverage Stats

26 of 27 new or added lines in 1 file covered. (96.3%)

16 existing lines in 1 file now uncovered.

1850 of 2038 relevant lines covered (90.78%)

747.32 hits per line