http3: reject responses that don't set the :status header (#3975)

http3/headers.go

@@ -177,6 +177,9 @@ func responseFromHeaders(headerFields []qpack.HeaderField) (*http.Response, erro
 	if err != nil {
 		return nil, err
 	}
+	if hdr.Status == "" {
+		return nil, errors.New("missing status field")
+	}
 	rsp := &http.Response{
 		Proto:         "HTTP/3.0",
 		ProtoMajor:    3,

http3/headers_test.go

@@ -317,6 +317,14 @@ var _ = Describe("Response", func() {
 		Expect(err).To(MatchError("received pseudo header :status after a regular header field"))
 	})
 
+	It("rejects response with no status field", func() {
+		headers := []qpack.HeaderField{
+			{Name: "content-length", Value: "42"},
+		}
+		_, err := responseFromHeaders(headers)
+		Expect(err).To(MatchError("missing status field"))
+	})
+
 	It("rejects invalid status codes", func() {
 		headers := []qpack.HeaderField{
 			{Name: ":status", Value: "foobar"},