net/http/internal/http2: reject non-identical duplicate Content-Length headers Per RFC 9112: "If a message is received without Transfer-Encoding and with an invalid Content-Length header field, then the message framing is invalid and the recipient MUST treat it as an unrecoverable error, unless the field value can be successfully parsed as a comma-separated list (Section 5.6.1 of [HTTP]), all values in the list are valid, and all values in the list are the same (in which case, the message is processed with that single value used as the Content-Length field value)." Therefore, similar to HTTP/1 server, ensure that HTTP/2 server rejects requests with duplicate Content-Length header fields that have different values. Unlike HTTP/1, we do not consider something like "123", and " 123" (with whitespace) to be the same value, since HPACK in HTTP/2 is strict about preceding and trailing whitespaces. Also note that we still silently allow invalid Content-Length value (defaulting to 0 if given "-3" for example). This is a pre-existing behavior in our implementation. Fixes #78746 Change-Id: I3904295a51f9dc4e67061c46f398762a6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/787621 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.
Gopher image by Renee French, licensed under Creative Commons 4.0 Attribution license.
Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.
Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.
Official binary distributions are available at https://go.dev/dl/.
After downloading a binary release, visit https://go.dev/doc/install for installation instructions.
If a binary distribution is not available for your combination of operating system and architecture, visit https://go.dev/doc/install/source for source installation instructions.
Go is the work of thousands of contributors. We appreciate your help!
To contribute, please read the contribution guidelines at https://go.dev/doc/contribute.
Note that the Go project uses the issue tracker for bug reports and proposals only. See https://go.dev/wiki/Questions for a list of places to ask questions about the Go language.