commit b2ed34f6fc8d65cc6a090fb87692ea6b1162fddd
author Brad Fitzpatrick <bradfitz@golang.org> Wed Jan 20 20:16:54 2016 +0000
committer Brad Fitzpatrick <bradfitz@golang.org> Wed Jan 20 22:26:53 2016 +0000
tree 4daa097b89fccd3f044c61a7e513d29769cde504
parent 78e1654ef40b8b993e3355307740b1cac8f1db20

http2: validate received header field values in Server and Transport

This validates incoming header field values in Server and Transport to
make sure the peer isn't sending us a \x00, CR, NL or other non-VCHAR
except space and tab.

It does not yet validate that we don't send such things, though.

Updates golang/go#14029

Change-Id: I7c6a56d5d0d255f1b8fa64480b34b3b5e1f4f367
Reviewed-on: https://go-review.googlesource.com/18727
Reviewed-by: Andrew Gerrand <adg@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>