gr1ffon/quic-go
1
0
Fork 0
forked from quic-go/quic-go
Code Pull Requests Activity

http3: reject responses that don't set the :status header (#3975)

Browse Source
This commit is contained in:
Marten Seemann
2023-07-18 22:26:46 -07:00
committed by GitHub
parent 5d59c3059f
commit b6dbfc8c06
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
http3/headers.go
View File

@@ -177,6 +177,9 @@ func responseFromHeaders(headerFields []qpack.HeaderField) (*http.Response, erro
if err != nil { if err != nil {
return nil, err return nil, err
} }
if hdr.Status == "" {
return nil, errors.New("missing status field")
}
rsp := &http.Response{ rsp := &http.Response{
Proto: "HTTP/3.0", Proto: "HTTP/3.0",
ProtoMajor: 3, ProtoMajor: 3,

8
http3/headers_test.go
View File

@@ -317,6 +317,14 @@ var _ = Describe("Response", func() {
Expect(err).To(MatchError("received pseudo header :status after a regular header field")) Expect(err).To(MatchError("received pseudo header :status after a regular header field"))
}) })
It("rejects response with no status field", func() {
headers := []qpack.HeaderField{
{Name: "content-length", Value: "42"},
}
_, err := responseFromHeaders(headers)
Expect(err).To(MatchError("missing status field"))
})
It("rejects invalid status codes", func() { It("rejects invalid status codes", func() {
headers := []qpack.HeaderField{ headers := []qpack.HeaderField{
{Name: ":status", Value: "foobar"}, {Name: ":status", Value: "foobar"},