arturobernalg opened a new pull request, #1122: URL: https://github.com/apache/tomcat/pull/1122
RFC 9113, section 3.2 requires that a server MUST NOT upgrade a connection to HTTP/2 if the HTTP2-Settings header value is not a valid BASE64URL encoding of an HTTP/2 SETTINGS payload. An HTTP/2 SETTINGS payload consists of zero or more 6-octet settings entries, so the decoded length must be a multiple of 6. Tomcat's Http2Protocol.accept() checked that exactly one HTTP2-Settings header was present and that it was listed in the Connection header, but did not validate the header value itself. As a result, upgrade requests carrying invalid base64url content or a value whose decoded length was not a multiple of 6 were accepted and a 101 Switching Protocols response was sent. This commit adds the missing validation in accept(): the header value is decoded with Base64.getUrlDecoder(); if decoding throws IllegalArgumentException or the decoded length is not a multiple of 6, the method returns false and the upgrade is refused. Two tests are added to TestHttp2Section_3_2 to cover both cases. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
