You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by "arturobernalg (via GitHub)" <gi...@apache.org> on 2023/09/19 19:03:07 UTC
[GitHub] [httpcomponents-core] arturobernalg commented on a diff in pull request #428: Add validation for :path pseudo-header in HTTP/2 requests RFC7540
arturobernalg commented on code in PR #428:
URL: https://github.com/apache/httpcomponents-core/pull/428#discussion_r1330579222
##########
httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/DefaultH2RequestConverter.java:
##########
@@ -208,4 +210,39 @@ public List<Header> convert(final HttpRequest message) throws HttpException {
return headers;
}
+ /**
+ * Validates the {@code :path} pseudo-header field based on the provided HTTP method and scheme.
+ * <p>
+ * This method performs the following validations:
+ * </p>
+ * <ul>
+ * <li><strong>Non-Empty Path:</strong> For 'http' or 'https' URIs, the {@code :path} pseudo-header field must not be empty.</li>
+ * <li><strong>OPTIONS Method:</strong> If the HTTP method is OPTIONS and the URI does not contain a path component,
+ * the {@code :path} pseudo-header field must have a value of '*'. </li>
+ * <li><strong>Path Starting with '/':</strong> For 'http' or 'https' URIs, the {@code :path} pseudo-header field must either start with '/' or be '*'. </li>
+ * </ul>
+ *
+ * @param method The HTTP method of the request, e.g., GET, POST, OPTIONS, etc.
+ * @param scheme The scheme of the request, e.g., http or https.
+ * @param path The value of the {@code :path} pseudo-header field.
+ * @throws ProtocolException if any of the validations fail.
+ */
+ private void validatePathPseudoHeader(final String method, final String scheme, final String path) throws ProtocolException {
+ if (URIScheme.HTTP.name().equalsIgnoreCase(scheme) || URIScheme.HTTPS.name().equalsIgnoreCase(scheme)) {
+ if (TextUtils.isBlank(path)) {
+ throw new ProtocolException("':path' pseudo-header field must not be empty for 'http' or 'https' URIs");
+ } else {
+ if (Method.OPTIONS.isSame(method)) {
+ if (!"*".equals(path)) {
+ throw new ProtocolException("OPTIONS request for an 'http' or 'https' URI without a path component must have a ':path' pseudo-header field with a value of '*'");
Review Comment:
@ok2c please check again.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org