HTTP/2: strip TE request header

The TE request header field is invalid in HTTP/2. Since clients may not
know in advance if a connection negotiates HTTP/2, automatically strip
such a header when h2 is in play.

Add test_01_10 to verify.

Reported-by: Jiri Stary
Fixes #15941
Closes #15943

diff --git a/lib/http.c b/lib/http.c
index e155200a52091b6ad499d35b28685b0d854bc202..52132059d1c5b7d977ca69d8d67acc5e04744a1e 100644 (file)
--- a/lib/http.c
+++ b/lib/http.c
@@ -4121,7 +4121,9 @@ struct name_const {
   size_t namelen;
 };
 
+/* keep them sorted by length! */
 static struct name_const H2_NON_FIELD[] = {
+  { STRCONST("TE") },
   { STRCONST("Host") },
   { STRCONST("Upgrade") },
   { STRCONST("Connection") },

diff --git a/tests/http/test_01_basic.py b/tests/http/test_01_basic.py
index 391c231516b1977fe9b478d850433647cad54353..9d70318f34aa7ff109f16a31f6fc70afe4314447 100644 (file)
--- a/tests/http/test_01_basic.py
+++ b/tests/http/test_01_basic.py
@@ -139,3 +139,13 @@ class TestBasic:
         assert r.response['status'] == 200, f'{r.responsw}'
         assert r.response['protocol'] == 'HTTP/2', f'{r.response}'
         assert r.json['server'] == env.domain1
+
+    # http: strip TE header in HTTP/2 requests
+    def test_01_10_te_strip(self, env: Env, httpd):
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, "h2")}/data.json'
+        r = curl.http_get(url=url, extra_args=['--http2', '-H', 'TE: gzip'])
+        r.check_exit_code(0)
+        assert len(r.responses) == 1, f'{r.responses}'
+        assert r.responses[0]['status'] == 200, f'{r.responses[1]}'
+        assert r.responses[0]['protocol'] == 'HTTP/2', f'{r.responses[1]}'