elixir-mint / mint
90%

DEFAULT BRANCH: main
Repo Added
Token xUOJjt5H7KcTvx6ikZQ7qWuMslrGKsjIE regen
Build 412 Last
Files 22
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x
Sync Branches

coverage: 90.476% (+0.08%) from 90.398%
7223c00ca363d295fb80b48167838d535cacbac6

push

github

web-flow 
Validate HTTP/2 request methods, targets and header fields (#545)

* Validate HTTP/2 request methods, targets and header fields

Mint.HTTP2.request/5 lowercased the header names it was given and
HPACK-encoded everything else as is, and stream_request_body/3 did the
same for trailers. A method, :path, CONNECT target, header name or
header value containing CR, LF or NUL, a header name containing a space
or a colon, or a value with leading or trailing whitespace was sent to
the server unchanged. Mint.HTTP1 rejects all of these, and Mint.HTTP2
rejects them in responses since #504, so the behaviour of a request
depended on which protocol ALPN negotiated.

RFC 9113 8.2.1 forbids these characters in field names and values and
says a sender must not generate such a message. HTTP/2 framing isn't
confused by them, but an intermediary that forwards the request over
HTTP/1.1 without re-validating the fields turns an injected CRLF into
request header injection or request splitting on its back-end
connection, so an application that is safe against an HTTP/1 origin
isn't once the origin or a CDN in front of it enables HTTP/2.

Requests and trailers are now validated before a stream is opened, with
the field rules already used for responses: the method must be a token
(RFC 9110 9.1), :path and the CONNECT :authority must be non-empty
field values (RFC 9113 8.3.1), pseudo-header names passed by the caller
must be valid field names, and trailers can't carry pseudo-headers (RFC
9113 8.1). Invalid input fails with :invalid_request_method,
:invalid_request_target, :invalid_header_name or :invalid_header_value,
like in Mint.HTTP1, and the connection stays open without the request
taking up a stream. The messages for the two header errors no longer
mention the response, since they now apply to requests as well.

* Validate caller-supplied HTTP/2 method fields

* Clarify HTTP/2 request field validation documentation

---------

Co-authored-by: Eric Meadows-Jönsson <eric.mead... (continued)

28 of 29 new or added lines in 1 file covered. (96.55%)

1843 of 2037 relevant lines covered (90.48%)

747.59 hits per line

Relevant lines Covered
2037 RELEVANT LINES 1843 COVERED LINES
747.59 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
7223c00c... main Validate HTTP/2 request methods, targets and header fields (#545) * Validate HTTP/2 request methods, targets and header fields Mint.HTTP2.request/5 lowercased the header names it was given and HPACK-encoded everything else as is, and stream_requ... push web-flow github
90.48
f0023243... fix/http2-validate-request-fields Clarify HTTP/2 request field validation documentation Pull #545 ericmj github
90.62
75d7f7db... fix/http2-validate-request-fields Validate HTTP/2 request methods, targets and header fields Mint.HTTP2.request/5 lowercased the header names it was given and HPACK-encoded everything else as is, and stream_request_body/3 did the same for trailers. A method, :path, CONNECT target... Pull #545 bmalum github
90.78
d54ba54a... main Fail requests pipelined behind a 101 response (#529) After a 101 response the connection stayed open with the queued requests in place, so bytes arriving later, which belong to the protocol the server switched to (RFC 9110 15.2.2), were parsed as... push web-flow github
90.4
5c51742a... fuzz-http1-transfer-codings Generate transfer codings with chunked first and last in the HTTP/1 fuzz Responses with more than one transfer coding could come up, as a generated Transfer-Encoding: chunked plus a random Transfer-Encoding: gzip header, but no invariant compared... Pull #543 ericmj github
90.46
ec007b03... fuzz-http2-connect-tunnel Treat 2xx responses to CONNECT as tunnels in the HTTP/2 fuzz model The fuzz property required zero body bytes for every 204 response. A 2xx response to CONNECT establishes a tunnel and the DATA frames after it are tunnel data (RFC 9110 section 9.... Pull #539 ericmj github
90.41
5677ece7... fuzz-http2-connection-window Derive the HTTP/2 fuzz model's connection window from client frames The model seeded the server's view of the connection window from Mint's own receive_window_remaining, so a client that kept a 16,777,216-byte window internally without sending th... Pull #542 ericmj github
90.51
89cfcce1... fuzz-http2-close-listen-socket Close the HTTP/2 test server listen socket after accepting TestServer.listen_and_accept/0 opened a TLS listen socket that nothing closed, so every HTTP/2 fuzz scenario left a listener behind: 200 scenarios grew the tcp_inet ports from 1 to 201 an... Pull #541 ericmj github
90.71
0ed0a9a1... test-http2-interim-no-101 Exclude 101 from random interim statuses in the HTTP/2 1xx test The "multiple before a single HEADERS" test picked each interim status from 100..199 and expected Mint to accept it. Mint rejects 101 in HTTP/2 since RFC 9113 section 8.6 doesn't sup... Pull #538 ericmj github
90.51
1209878a... fuzz-http1-mid-scenario-requests Run mid-scenario requests in the HTTP/1 fuzz property Client operations are {index, :body, ref_index, chunk} or {index, :request, {method, body}}, but the comprehension that picks the operations for the current chunk only matched four-element tup... Pull #540 ericmj github
90.41
See All Builds (344)

Badge your Repo: mint

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh