net/http/internal/http2: reject non-identical duplicate Content-Length headers

Per RFC 9112:

"If a message is received without Transfer-Encoding and with an invalid
Content-Length header field, then the message framing is invalid and the
recipient MUST treat it as an unrecoverable error, unless the field
value can be successfully parsed as a comma-separated list (Section
5.6.1 of [HTTP]), all values in the list are valid, and all values in
the list are the same (in which case, the message is processed with that
single value used as the Content-Length field value)."

Therefore, similar to HTTP/1 server, ensure that HTTP/2 server rejects
requests with duplicate Content-Length header fields that have different
values. Unlike HTTP/1, we do not consider something like "123", and "
123" (with whitespace) to be the same value, since HPACK in HTTP/2 is
strict about preceding and trailing whitespaces.

Also note that we still silently allow invalid Content-Length value
(defaulting to 0 if given "-3" for example). This is a pre-existing
behavior in our implementation.

Fixes #78746

Change-Id: I3904295a51f9dc4e67061c46f398762a6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/787621
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Nicholas Husin <husin@google.com>
2 files changed
tree: ee32dd73c2038a9609ec8b38a98d2bd6b2f6611b
  1. .github/
  2. api/
  3. doc/
  4. lib/
  5. misc/
  6. src/
  7. test/
  8. .gitattributes
  9. .gitignore
  10. codereview.cfg
  11. CONTRIBUTING.md
  12. go.env
  13. LICENSE
  14. PATENTS
  15. README.md
  16. SECURITY.md
README.md

The Go Programming Language

Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.

Gopher image Gopher image by Renee French, licensed under Creative Commons 4.0 Attribution license.

Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.

Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.

Download and Install

Binary Distributions

Official binary distributions are available at https://go.dev/dl/.

After downloading a binary release, visit https://go.dev/doc/install for installation instructions.

Install From Source

If a binary distribution is not available for your combination of operating system and architecture, visit https://go.dev/doc/install/source for source installation instructions.

Contributing

Go is the work of thousands of contributors. We appreciate your help!

To contribute, please read the contribution guidelines at https://go.dev/doc/contribute.

Note that the Go project uses the issue tracker for bug reports and proposals only. See https://go.dev/wiki/Questions for a list of places to ask questions about the Go language.