elixir-mint / mint / 7223c00ca363d295fb80b48167838d535cacbac6

90%

push

github

Validate HTTP/2 request methods, targets and header fields (#545)

* Validate HTTP/2 request methods, targets and header fields

Mint.HTTP2.request/5 lowercased the header names it was given and
HPACK-encoded everything else as is, and stream_request_body/3 did the
same for trailers. A method, :path, CONNECT target, header name or
header value containing CR, LF or NUL, a header name containing a space
or a colon, or a value with leading or trailing whitespace was sent to
the server unchanged. Mint.HTTP1 rejects all of these, and Mint.HTTP2
rejects them in responses since #504, so the behaviour of a request
depended on which protocol ALPN negotiated.

RFC 9113 8.2.1 forbids these characters in field names and values and
says a sender must not generate such a message. HTTP/2 framing isn't
confused by them, but an intermediary that forwards the request over
HTTP/1.1 without re-validating the fields turns an injected CRLF into
request header injection or request splitting on its back-end
connection, so an application that is safe against an HTTP/1 origin
isn't once the origin or a CDN in front of it enables HTTP/2.

Requests and trailers are now validated before a stream is opened, with
the field rules already used for responses: the method must be a token
(RFC 9110 9.1), :path and the CONNECT :authority must be non-empty
field values (RFC 9113 8.3.1), pseudo-header names passed by the caller
must be valid field names, and trailers can't carry pseudo-headers (RFC
9113 8.1). Invalid input fails with :invalid_request_method,
:invalid_request_target, :invalid_header_name or :invalid_header_value,
like in Mint.HTTP1, and the connection stays open without the request
taking up a stream. The messages for the two header errors no longer
mention the response, since they now apply to requests as well.

* Validate caller-supplied HTTP/2 method fields

* Clarify HTTP/2 request field validation documentation

---------

Co-authored-by: Eric Meadows-Jönsson <eric.mead... (continued)

28 of 29 new or added lines in 1 file covered. (96.55%)

1843 of 2037 relevant lines covered (90.48%)

747.59 hits per line