[libsoup] http2: make sure the request doesn't include any invalid header

[Carlos Garcia Campos <carlosgc src gnome org>]

commit b3912182960aab27df001889febf7093a1b587e8
Author: Carlos Garcia Campos <cgarcia igalia com>
Date:   Thu May 20 11:12:18 2021 +0200

    http2: make sure the request doesn't include any invalid header

 libsoup/http2/soup-client-message-io-http2.c | 21 +++++++++++++++++++--
 tests/http2-test.c                           | 27 +++++++++++++++++++++++++++
 2 files changed, 46 insertions(+), 2 deletions(-)
---
diff --git a/libsoup/http2/soup-client-message-io-http2.c b/libsoup/http2/soup-client-message-io-http2.c
index 0b09ee14..765be4b8 100644
--- a/libsoup/http2/soup-client-message-io-http2.c
+++ b/libsoup/http2/soup-client-message-io-http2.c
@@ -783,6 +783,23 @@ soup_http2_message_data_free (SoupHTTP2MessageData *data)
         g_free (data);
 }
 
+static gboolean
+request_header_is_valid (const char *name)
+{
+        static GHashTable *invalid_request_headers = NULL;
+
+        if (!invalid_request_headers) {
+                invalid_request_headers = g_hash_table_new (soup_str_case_hash, soup_str_case_equal);
+                g_hash_table_add (invalid_request_headers, "Connection");
+                g_hash_table_add (invalid_request_headers, "Keep-Alive");
+                g_hash_table_add (invalid_request_headers, "Proxy-Connection");
+                g_hash_table_add (invalid_request_headers, "Transfer-Encoding");
+                g_hash_table_add (invalid_request_headers, "Upgrade");
+        }
+
+        return !g_hash_table_contains (invalid_request_headers, name);
+}
+
 #define MAKE_NV(NAME, VALUE, VALUELEN)                                      \
         {                                                                   \
                 (uint8_t *)NAME, (uint8_t *)VALUE, strlen (NAME), VALUELEN, \
@@ -833,9 +850,9 @@ send_message_request (SoupMessage          *msg,
         const char *name, *value;
         soup_message_headers_iter_init (&iter, soup_message_get_request_headers (msg));
         while (soup_message_headers_iter_next (&iter, &name, &value)) {
-                /* Forbidden headers. TODO: Avoid setting this elsewhere? */
-                if (g_ascii_strcasecmp (name, "Transfer-Encoding") == 0)
+                if (!request_header_is_valid (name))
                         continue;
+
                 const nghttp2_nv nv = MAKE_NV2 (name, value);
                 g_array_append_val (headers, nv);
         }
diff --git a/tests/http2-test.c b/tests/http2-test.c
index d5c75c43..c12f86a0 100644
--- a/tests/http2-test.c
+++ b/tests/http2-test.c
@@ -549,6 +549,29 @@ do_preconnect_test (Test *test, gconstpointer data)
         g_main_context_unref (async_context);
 }
 
+static void
+do_invalid_header_test (Test *test, gconstpointer data)
+{
+        static const char *invalid_headers[] = { "Connection", "Keep-Alive", "Proxy-Connection", 
"Transfer-Encoding", "Upgrade" };
+        guint i;
+
+        for (i = 0; i < G_N_ELEMENTS (invalid_headers); i++) {
+                SoupMessage *msg;
+                SoupMessageHeaders *request_headers;
+                GBytes *body;
+                GError *error = NULL;
+
+                msg = soup_message_new (SOUP_METHOD_GET, "https://127.0.0.1:5000/";);
+                request_headers = soup_message_get_request_headers (msg);
+                soup_message_headers_append (request_headers, invalid_headers[i], "Value");
+                body = soup_test_session_async_send (test->session, msg, NULL, &error);
+                g_assert_no_error (error);
+                g_assert_cmpstr (g_bytes_get_data (body, NULL), ==, "Hello world");
+                g_bytes_unref (body);
+                g_object_unref (msg);
+        }
+}
+
 int
 main (int argc, char **argv)
 {
@@ -627,6 +650,10 @@ main (int argc, char **argv)
                     setup_session,
                     do_cancellation_test,
                     teardown_session);
+        g_test_add ("/http2/invalid-header", Test, NULL,
+                    setup_session,
+                    do_invalid_header_test,
+                    teardown_session);