Add validation for :path pseudo-header in HTTP/2 requests RFC7540 #428
Conversation
There was a problem hiding this comment.
@arturobernalg What RFC have you been using as a reference for change?
httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/DefaultH2RequestConverter.java
Outdated
Show resolved
Hide resolved
arturobernalg
force-pushed
the
path-pseudo-header
branch
from
3f9f98d to
bbd103b
Compare
This specific section: |
| } else { | ||
| if (Method.OPTIONS.isSame(method)) { | ||
| if (!"*".equals(path)) { | ||
| throw new ProtocolException("OPTIONS request for an 'http' or 'https' URI without a path component must have a ':path' pseudo-header field with a value of '*'"); |
There was a problem hiding this comment.
@arturobernalg This still looks wrong. Why should OPTIONS with the / path should be rejected as invalid? What you want to do it reject the path if it does not start with '/' but make an exception for OPTIONS if the path is *.
There was a problem hiding this comment.
@ok2c please check again.
This commit adds robust validation for the :path pseudo-header field in HTTP/2 requests, as specified in RFC 7540. It ensures that: - The :path field is not empty for 'http' or 'https' URIs. - For OPTIONS requests without a path component, the :path field must be '*'. - For 'http' or 'https' URIs, the :path field must either start with '/' or be '*'.
arturobernalg
force-pushed
the
path-pseudo-header
branch
from
c7073ee to
eb7c43d
Compare
…#428) This commit adds robust validation for the :path pseudo-header field in HTTP/2 requests, as specified in RFC 7540. It ensures that: - The :path field is not empty for 'http' or 'https' URIs. - For OPTIONS requests without a path component, the :path field must be '*'. - For 'http' or 'https' URIs, the :path field must either start with '/' or be '*'.
This PR introduces validations for the :path pseudo-header field in accordance with the HTTP/2 specifications:
Ensures the :path pseudo-header field correctly represents the path and query parts of the target URI. Adheres to the "path-absolute" production. Optionally allows for a '?' character followed by the "query" production (as per Sections 3.3 and 3.4 of [RFC3986]).
Validates that requests in asterisk form have the value '*' for the :path pseudo-header field.
Enforces that the :path pseudo-header field is not left empty for "http" or "https" URIs.
Guarantees that "http" or "https" URIs without a path component include a '/' value for the :path pseudo-header field.
Implements an exception for OPTIONS requests:
If the request targets an "http" or "https" URI and lacks a path component, it must set the :path pseudo-header field to '*'.