walkero
/
nghttp2
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Disallow upper-cased header field name

This commit is contained in:
Tatsuhiro Tsujikawa 2015-02-24 18:45:59 +09:00
parent 1a2bccd71c
commit f2a498e3c4
1 changed files with 27 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
lib/nghttp2_http.c
View File

@ -382,15 +382,33 @@ static int http_response_on_header(nghttp2_stream *stream, nghttp2_nv *nv,
int nghttp2_http_on_header(nghttp2_session *session, nghttp2_stream *stream, int nghttp2_http_on_header(nghttp2_session *session, nghttp2_stream *stream,
nghttp2_frame *frame, nghttp2_nv *nv, int trailer) { nghttp2_frame *frame, nghttp2_nv *nv, int trailer) {
if (!nghttp2_check_header_name(nv->name, nv->namelen) || /* We are strict for pseudo header field. One bad character should
!nghttp2_check_header_value(nv->value, nv->valuelen)) { lead to fail. OTOH, we should be a bit forgiving for regular
/* We are strict for pseudo header field. One bad character headers, since existing public internet has so much illegal
should lead to fail. OTOH, we should be a bit forgiving for headers floating around and if we kill the stream because of
regular headers, since existing public internet has so much this, we may disrupt many web sites and/or libraries. So we
illegal headers floating around and if we kill the stream become conservative here, and just ignore those illegal regular
because of this, we may disrupt many web sites and/or headers. */
libraries. So we become conservative here, and just ignore if (!nghttp2_check_header_name(nv->name, nv->namelen)) {
those illegal regular headers. */ size_t i;
if (nv->namelen > 0 && nv->name[0] == ':') {
return -1;
}
/* header field name must be lower-cased without exception */
for (i = 0; i < nv->namelen; ++i) {
char c = nv->name[i];
if ('A' <= c && c <= 'Z') {
return -1;
}
}
/* When ignoring regular headers, we set this flag so that we
still enforce header field ordering rule for pseudo header
fields. */
stream->http_flags |= NGHTTP2_HTTP_FLAG_PSEUDO_HEADER_DISALLOWED;
return 1;
}
if (!nghttp2_check_header_value(nv->value, nv->valuelen)) {
if (nv->namelen > 0 && nv->name[0] == ':') { if (nv->namelen > 0 && nv->name[0] == ':') {
return -1; return -1;
} }