BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server

The H2 mux properly drops userinfo from authority on input but doesn't
drop it on output if present on input (e.g. coming from H1), which will
cause a bad request when reaching a compliant H2 server such as itself.
Let's make sure it is properly dropped there as well, as required by
RFC9113. This should be backported to all stable versions.

Reported-by: Claude (ANT-2026-R03JNY63)

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 6b1dcbc3f2342c6be9f4dc9ecfcad204409b9e4b..937d5f4db8e4f2377ec54094a06469a7b7afc9ee 100644 (file)
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -7111,6 +7111,7 @@ static size_t h2s_snd_bhdrs(struct h2s *h2s, struct htx *htx)
                 * from rfc 8441.
                 */
                struct ist scheme = { };
+               struct ist at;
 
                if (uri.ptr[0] != '/' && uri.ptr[0] != '*') {
                        /* the URI seems to start with a scheme */
@@ -7130,6 +7131,11 @@ static size_t h2s_snd_bhdrs(struct h2s *h2s, struct htx *htx)
                                        auth.len++;
 
                                uri = istadv(uri, auth.len);
+
+                               /* RFC9113#8.3.1: :authority must not carry the deprecated userinfo */
+                               at = istfind(auth, '@');
+                               if (istlen(at))
+                                       auth = istadv(at, 1);
                        }
                }