[GH] (pekko-http/fix/http2-field-name-case-and-whitespace): Workflow run "Validate and test" failed!

[GitBox <gi...@apache.org>]

The GitHub Actions job "Validate and test" on pekko-http.git/fix/http2-field-name-case-and-whitespace has failed.
Run started by GitHub user pjfanning (triggered by pjfanning).

Head commit for run:
7ee823257e5813d7cd1ee344203dc7b25cc5b819 / PJ Fanning <pj...@users.noreply.github.com>
fix: reject uppercase HTTP/2 field names and values with surrounding whitespace

Motivation:
RFC 9113 8.2.1 makes an HTTP/2 message malformed when a field name contains an
uppercase character or a field value starts or ends with SP or HTAB. Pekko HTTP accepted
both: regular fields are handed to the HTTP/1.1 header-line parser, which matches names
case-insensitively and trims the value, so the message was silently normalised instead of
rejected. Other HTTP/2 implementations (nghttp2, netty for names) reject them, so two hops
can disagree about the same field.

On the client, a field rejected in HeaderDecompression left the response with no headers
and was reported as a missing ':status' rather than as what was wrong.

Modification:
- HeaderDecompression rejects an uppercase field name and a value with leading or
  trailing SP/HTAB, next to the existing NUL/CR/LF check. The messages from this stage
  drop the "Malformed request:" prefix, since it decodes responses on the client too.
- ResponseParsing reports a header error from decompression as
  "Malformed response: <reason>".
- Lowercase the incidental uppercase names ("Foo", "Connection", "TE") in RequestParsingSpec
  tests that check other rules, and let the ':authority'/':path' tests that pass
  whitespace-only or whitespace-terminated values accept the earlier field-check message.
- Add a ResponseParsingSpec for the client side.

Result:
Requests with such fields get a 400 for the stream; responses with them fail with a
protocol error naming the field problem. Pekko HTTP's own client and server always render
lowercase names, so traffic between them is unaffected.

Tests:
- Without the main change the new RequestParsingSpec uppercase/whitespace tests and the
  ResponseParsingSpec rejection tests fail
- sbt http2-tests/test: 393 passed
- sbt http-core/mimaReportBinaryIssues and scalafmt checks: pass

References:
None - follow-up to #1341

Report URL: https://github.com/apache/pekko-http/actions/runs/38055744089

With regards,
GitHub Actions via GitBox


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org