You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ab...@apache.org on 2026/02/24 10:27:45 UTC
(httpcomponents-core) branch master updated: TTP/2: validate pseudo-headers in inbound request trailers (#637)
This is an automated email from the ASF dual-hosted git repository.
abernal pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/httpcomponents-core.git
The following commit(s) were added to refs/heads/master by this push:
new 9729123f0 TTP/2: validate pseudo-headers in inbound request trailers (#637)
9729123f0 is described below
commit 9729123f0b6d361691bfe0786f85c1dcbc576f0a
Author: Arturo Bernal <ab...@apache.org>
AuthorDate: Tue Feb 24 10:27:40 2026 +0000
TTP/2: validate pseudo-headers in inbound request trailers (#637)
ServerH2StreamHandler forwarded inbound request trailers (HEADERS in BODY
state) directly to AsyncServerExchangeHandler.streamEnd(...) without
validating trailer semantics. This allowed pseudo-header fields (':...')
to slip through on the server path.
---
.../http2/impl/nio/ServerH2StreamHandler.java | 11 +++-
.../http2/impl/nio/TestServerH2StreamHandler.java | 67 ++++++++++++++++++++++
2 files changed, 77 insertions(+), 1 deletion(-)
diff --git a/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/ServerH2StreamHandler.java b/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/ServerH2StreamHandler.java
index 55316d0a9..2313d2ec9 100644
--- a/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/ServerH2StreamHandler.java
+++ b/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/ServerH2StreamHandler.java
@@ -265,7 +265,16 @@ public void consumeHeader(final List<Header> headers, final boolean endStream) t
}
break;
case BODY:
- responseState.set(MessageState.COMPLETE);
+ if (!endStream) {
+ throw new H2StreamResetException(H2Error.PROTOCOL_ERROR, "Trailer headers must set END_STREAM");
+ }
+ try {
+ TrailersValidationSupport.verify(headers);
+ } catch (final ProtocolException ex) {
+ throw new H2StreamResetException(H2Error.PROTOCOL_ERROR, ex.getMessage());
+ }
+ requestState.set(MessageState.COMPLETE);
+ Asserts.notNull(exchangeHandler, "Exchange handler");
exchangeHandler.streamEnd(headers);
break;
default:
diff --git a/httpcore5-h2/src/test/java/org/apache/hc/core5/http2/impl/nio/TestServerH2StreamHandler.java b/httpcore5-h2/src/test/java/org/apache/hc/core5/http2/impl/nio/TestServerH2StreamHandler.java
index cf3f7c5a1..6d4e71f96 100644
--- a/httpcore5-h2/src/test/java/org/apache/hc/core5/http2/impl/nio/TestServerH2StreamHandler.java
+++ b/httpcore5-h2/src/test/java/org/apache/hc/core5/http2/impl/nio/TestServerH2StreamHandler.java
@@ -27,16 +27,24 @@
package org.apache.hc.core5.http2.impl.nio;
import java.nio.ByteBuffer;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import org.apache.hc.core5.http.Header;
import org.apache.hc.core5.http.ProtocolException;
import org.apache.hc.core5.http.impl.BasicHttpConnectionMetrics;
import org.apache.hc.core5.http.impl.BasicHttpTransportMetrics;
+import org.apache.hc.core5.http.message.BasicHeader;
import org.apache.hc.core5.http.nio.AsyncServerExchangeHandler;
import org.apache.hc.core5.http.nio.HandlerFactory;
import org.apache.hc.core5.http.protocol.HttpCoreContext;
import org.apache.hc.core5.http.protocol.HttpProcessor;
+import org.apache.hc.core5.http2.H2Error;
+import org.apache.hc.core5.http2.H2StreamResetException;
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentMatchers;
import org.mockito.Mockito;
class TestServerH2StreamHandler {
@@ -81,4 +89,63 @@ void toStringIncludesStates() {
Assertions.assertTrue(text.contains("responseState"));
}
+ @Test
+ void consumeTrailersWithPseudoHeaderRejected() throws Exception {
+ final H2StreamChannel channel = Mockito.mock(H2StreamChannel.class);
+ final HttpProcessor httpProcessor = Mockito.mock(HttpProcessor.class);
+ final BasicHttpConnectionMetrics metrics = new BasicHttpConnectionMetrics(
+ new BasicHttpTransportMetrics(), new BasicHttpTransportMetrics());
+ final AsyncServerExchangeHandler exchangeHandler = Mockito.mock(AsyncServerExchangeHandler.class);
+ @SuppressWarnings("unchecked")
+ final HandlerFactory<AsyncServerExchangeHandler> exchangeHandlerFactory =
+ (HandlerFactory<AsyncServerExchangeHandler>) Mockito.mock(HandlerFactory.class);
+ Mockito.when(exchangeHandlerFactory.create(ArgumentMatchers.any(), ArgumentMatchers.any()))
+ .thenReturn(exchangeHandler);
+
+ final ServerH2StreamHandler handler = new ServerH2StreamHandler(
+ channel, httpProcessor, metrics, exchangeHandlerFactory, HttpCoreContext.create());
+
+ final List<Header> requestHeaders = Arrays.asList(
+ new BasicHeader(":method", "POST"),
+ new BasicHeader(":scheme", "https"),
+ new BasicHeader(":authority", "example.test"),
+ new BasicHeader(":path", "/upload"));
+ handler.consumeHeader(requestHeaders, false);
+
+ final List<Header> trailers = Collections.singletonList(new BasicHeader(":status", "200"));
+ Assertions.assertThrows(H2StreamResetException.class, () -> handler.consumeHeader(trailers, true));
+ Mockito.verify(exchangeHandler, Mockito.never()).streamEnd(ArgumentMatchers.anyList());
+ }
+
+ @Test
+ void consumeTrailersWithoutEndStreamRejected() throws Exception {
+ final H2StreamChannel channel = Mockito.mock(H2StreamChannel.class);
+ final HttpProcessor httpProcessor = Mockito.mock(HttpProcessor.class);
+ final BasicHttpConnectionMetrics metrics = new BasicHttpConnectionMetrics(
+ new BasicHttpTransportMetrics(), new BasicHttpTransportMetrics());
+ final AsyncServerExchangeHandler exchangeHandler = Mockito.mock(AsyncServerExchangeHandler.class);
+ @SuppressWarnings("unchecked")
+ final HandlerFactory<AsyncServerExchangeHandler> exchangeHandlerFactory =
+ (HandlerFactory<AsyncServerExchangeHandler>) Mockito.mock(HandlerFactory.class);
+ Mockito.when(exchangeHandlerFactory.create(ArgumentMatchers.any(), ArgumentMatchers.any()))
+ .thenReturn(exchangeHandler);
+
+ final ServerH2StreamHandler handler = new ServerH2StreamHandler(
+ channel, httpProcessor, metrics, exchangeHandlerFactory, HttpCoreContext.create());
+
+ final List<Header> requestHeaders = Arrays.asList(
+ new BasicHeader(":method", "POST"),
+ new BasicHeader(":scheme", "https"),
+ new BasicHeader(":authority", "example.test"),
+ new BasicHeader(":path", "/upload"));
+ handler.consumeHeader(requestHeaders, false);
+
+ final List<Header> trailers = Collections.singletonList(new BasicHeader("x-checksum", "abc123"));
+ final H2StreamResetException ex = Assertions.assertThrows(
+ H2StreamResetException.class,
+ () -> handler.consumeHeader(trailers, false));
+ Assertions.assertEquals(H2Error.PROTOCOL_ERROR, H2Error.getByCode(ex.getCode()));
+ Mockito.verify(exchangeHandler, Mockito.never()).streamEnd(ArgumentMatchers.anyList());
+ }
+
}