[tomcat] 06/06: Fix server push. Validation will see pseudo headers so should allow them

[markt]

This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 10.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit 9e417fad44ff903e47f3b2c27350f0d9bca76af7
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Fri Jan 14 19:25:35 2022 +0000

    Fix server push. Validation will see pseudo headers so should allow them
---
 java/org/apache/coyote/http2/StreamProcessor.java | 19 ++++++++++++++++++-
 webapps/docs/changelog.xml                        |  8 ++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/java/org/apache/coyote/http2/StreamProcessor.java 
b/java/org/apache/coyote/http2/StreamProcessor.java
index 2334af4..42e1e5d 100644
--- a/java/org/apache/coyote/http2/StreamProcessor.java
+++ b/java/org/apache/coyote/http2/StreamProcessor.java
@@ -19,7 +19,9 @@ package org.apache.coyote.http2;
 import java.io.File;
 import java.io.IOException;
 import java.util.Enumeration;
+import java.util.HashSet;
 import java.util.Iterator;
+import java.util.Set;
 
 import jakarta.servlet.http.HttpServletResponse;
 
@@ -51,11 +53,19 @@ class StreamProcessor extends AbstractProcessor {
     private static final Log log = LogFactory.getLog(StreamProcessor.class);
     private static final StringManager sm = 
StringManager.getManager(StreamProcessor.class);
 
+    private static final Set<String> H2_PSEUDO_HEADERS_REQUEST = new 
HashSet<>();
+
     private final Http2UpgradeHandler handler;
     private final Stream stream;
     private SendfileData sendfileData = null;
     private SendfileState sendfileState = null;
 
+    static {
+        H2_PSEUDO_HEADERS_REQUEST.add(":method");
+        H2_PSEUDO_HEADERS_REQUEST.add(":scheme");
+        H2_PSEUDO_HEADERS_REQUEST.add(":authority");
+        H2_PSEUDO_HEADERS_REQUEST.add(":path");
+    }
 
     StreamProcessor(Http2UpgradeHandler handler, Stream stream, Adapter 
adapter,
             SocketWrapperBase<?> socketWrapper) {
@@ -495,9 +505,16 @@ class StreamProcessor extends AbstractProcessor {
 
         // HTTP header names must be tokens.
         MimeHeaders headers = request.getMimeHeaders();
+        boolean previousHeaderWasPseudoHeader = true;
         Enumeration<String> names = headers.names();
         while (names.hasMoreElements()) {
-            if (!HttpParser.isToken(names.nextElement())) {
+            String name = names.nextElement();
+            if (H2_PSEUDO_HEADERS_REQUEST.contains(name)) {
+                if (!previousHeaderWasPseudoHeader) {
+                    return false;
+                }
+            } else if (!HttpParser.isToken(name)) {
+                previousHeaderWasPseudoHeader = false;
                 return false;
             }
         }
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 3d9f269..c3d44a2 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -105,6 +105,14 @@
   issues do not "pop up" wrt. others).
 -->
 <section name="Tomcat 10.0.16 (markt)" rtext="in development">
+  <subsection name="Coyote">
+    <changelog>
+      <fix>
+        Correct a regression in the fix for <bug>65785</bug> that broke HTTP/2
+        server push. (markt)
+      </fix>
+    </changelog>
+  </subsection>
   <subsection name="Other">
     <changelog>
       <scode>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org