Skip to content

Validate all TE header instances for HTTP/2 request conformance.#620

Merged
arturobernalg merged 1 commit intoapache:masterfrom
arturobernalg:te
Feb 18, 2026
Merged

Validate all TE header instances for HTTP/2 request conformance.#620
arturobernalg merged 1 commit intoapache:masterfrom
arturobernalg:te

Conversation

@arturobernalg
Copy link
Member

Reject any TE value other than trailers (including additional TE headers).

@arturobernalg arturobernalg requested a review from ok2c February 16, 2026 10:59
@arturobernalg arturobernalg force-pushed the te branch 2 times, most recently from 1699f8f to 1342a90 Compare February 16, 2026 13:51
@arturobernalg arturobernalg requested a review from ok2c February 16, 2026 13:52
@ok2c
Copy link
Member

ok2c commented Feb 17, 2026

@arturobernalg I would rewrite it as

    @Override
    public void process(final HttpRequest request, final EntityDetails entity, final HttpContext localContext)
            throws HttpException, IOException {
        Args.notNull(request, "HTTP request");
        for (int i = 0; i < illegalHeaderNames.length; i++) {
            final String headerName = illegalHeaderNames[i];
            if (request.containsHeader(headerName)) {
                if (HttpHeaders.TE.equalsIgnoreCase(headerName)) {
                    validateTE(request);
                } else {
                    throw new ProtocolException("Header '%s' is illegal for HTTP/2 messages", headerName);
                }
            }
        }
    }

    private static void validateTE(final HttpRequest request) throws ProtocolException {
        boolean sawAnyToken = false;
        boolean sawInvalidToken = false;
        for (final Iterator<String> it = MessageSupport.iterateTokens(request, HttpHeaders.TE); it.hasNext(); ) {
            final String token = it.next();
            sawAnyToken = true;
            if (!"trailers".equalsIgnoreCase(token)) {
                sawInvalidToken = true;
                break;
            }
        }
        if (sawInvalidToken || !sawAnyToken) {
            throw new ProtocolException("Header '%s' is illegal for HTTP/2 messages", HttpHeaders.TE);
        }
    }

Reject any TE value other than trailers (including additional TE headers).
@arturobernalg
Copy link
Member Author

@arturobernalg I would rewrite it as

    @Override
    public void process(final HttpRequest request, final EntityDetails entity, final HttpContext localContext)
            throws HttpException, IOException {
        Args.notNull(request, "HTTP request");
        for (int i = 0; i < illegalHeaderNames.length; i++) {
            final String headerName = illegalHeaderNames[i];
            if (request.containsHeader(headerName)) {
                if (HttpHeaders.TE.equalsIgnoreCase(headerName)) {
                    validateTE(request);
                } else {
                    throw new ProtocolException("Header '%s' is illegal for HTTP/2 messages", headerName);
                }
            }
        }
    }

    private static void validateTE(final HttpRequest request) throws ProtocolException {
        boolean sawAnyToken = false;
        boolean sawInvalidToken = false;
        for (final Iterator<String> it = MessageSupport.iterateTokens(request, HttpHeaders.TE); it.hasNext(); ) {
            final String token = it.next();
            sawAnyToken = true;
            if (!"trailers".equalsIgnoreCase(token)) {
                sawInvalidToken = true;
                break;
            }
        }
        if (sawInvalidToken || !sawAnyToken) {
            throw new ProtocolException("Header '%s' is illegal for HTTP/2 messages", HttpHeaders.TE);
        }
    }

@ok2c All right. I made the change

@arturobernalg arturobernalg merged commit cd18a1c into apache:master Feb 18, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Comments