1 // Copyright 2016 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/spdy/header_coalescer.h"
6
7 #include <memory>
8 #include <string>
9 #include <string_view>
10 #include <utility>
11
12 #include "base/ranges/algorithm.h"
13 #include "base/strings/string_util.h"
14 #include "base/strings/stringprintf.h"
15 #include "base/trace_event/memory_usage_estimator.h"
16 #include "base/values.h"
17 #include "net/http/http_log_util.h"
18 #include "net/http/http_util.h"
19 #include "net/log/net_log_values.h"
20
21 namespace net {
22 namespace {
23
NetLogInvalidHeader(const NetLogWithSource & net_log,std::string_view header_name,std::string_view header_value,const char * error_message)24 void NetLogInvalidHeader(const NetLogWithSource& net_log,
25 std::string_view header_name,
26 std::string_view header_value,
27 const char* error_message) {
28 net_log.AddEvent(NetLogEventType::HTTP2_SESSION_RECV_INVALID_HEADER,
29 [&](NetLogCaptureMode capture_mode) {
30 return base::Value::Dict()
31 .Set("header_name", NetLogStringValue(header_name))
32 .Set("header_value",
33 NetLogStringValue(ElideHeaderValueForNetLog(
34 capture_mode, std::string(header_name),
35 std::string(header_value))))
36 .Set("error", error_message);
37 });
38 }
39
ContainsUppercaseAscii(std::string_view str)40 bool ContainsUppercaseAscii(std::string_view str) {
41 return base::ranges::any_of(str, base::IsAsciiUpper<char>);
42 }
43
44 } // namespace
45
HeaderCoalescer(uint32_t max_header_list_size,const NetLogWithSource & net_log)46 HeaderCoalescer::HeaderCoalescer(uint32_t max_header_list_size,
47 const NetLogWithSource& net_log)
48 : max_header_list_size_(max_header_list_size), net_log_(net_log) {}
49
OnHeader(std::string_view key,absl::string_view value)50 void HeaderCoalescer::OnHeader(std::string_view key, absl::string_view value) {
51 if (error_seen_)
52 return;
53 if (!AddHeader(key, value)) {
54 error_seen_ = true;
55 }
56 }
57
release_headers()58 spdy::Http2HeaderBlock HeaderCoalescer::release_headers() {
59 DCHECK(headers_valid_);
60 headers_valid_ = false;
61 return std::move(headers_);
62 }
63
AddHeader(std::string_view key,std::string_view value)64 bool HeaderCoalescer::AddHeader(std::string_view key, std::string_view value) {
65 if (key.empty()) {
66 NetLogInvalidHeader(net_log_, key, value, "Header name must not be empty.");
67 return false;
68 }
69
70 std::string_view key_name = key;
71 if (key[0] == ':') {
72 if (regular_header_seen_) {
73 NetLogInvalidHeader(net_log_, key, value,
74 "Pseudo header must not follow regular headers.");
75 return false;
76 }
77 key_name.remove_prefix(1);
78 } else if (!regular_header_seen_) {
79 regular_header_seen_ = true;
80 }
81
82 if (!HttpUtil::IsValidHeaderName(key_name)) {
83 NetLogInvalidHeader(net_log_, key, value,
84 "Invalid character in header name.");
85 return false;
86 }
87
88 if (ContainsUppercaseAscii(key_name)) {
89 NetLogInvalidHeader(net_log_, key, value,
90 "Upper case characters in header name.");
91 return false;
92 }
93
94 // 32 byte overhead according to RFC 7540 Section 6.5.2.
95 header_list_size_ += key.size() + value.size() + 32;
96 if (header_list_size_ > max_header_list_size_) {
97 NetLogInvalidHeader(net_log_, key, value, "Header list too large.");
98 return false;
99 }
100
101 // RFC 7540 Section 10.3: "Any request or response that contains a character
102 // not permitted in a header field value MUST be treated as malformed (Section
103 // 8.1.2.6). Valid characters are defined by the field-content ABNF rule in
104 // Section 3.2 of [RFC7230]." RFC 7230 Section 3.2 says:
105 // field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
106 // field-vchar = VCHAR / obs-text
107 // RFC 5234 Appendix B.1 defines |VCHAR|:
108 // VCHAR = %x21-7E
109 // RFC 7230 Section 3.2.6 defines |obs-text|:
110 // obs-text = %x80-FF
111 // Therefore allowed characters are '\t' (HTAB), x20 (SP), x21-7E, and x80-FF.
112 for (const unsigned char c : value) {
113 if (c < '\t' || ('\t' < c && c < 0x20) || c == 0x7f) {
114 std::string error_line;
115 base::StringAppendF(&error_line,
116 "Invalid character 0x%02X in header value.", c);
117 NetLogInvalidHeader(net_log_, key, value, error_line.c_str());
118 return false;
119 }
120 }
121
122 headers_.AppendValueOrAddHeader(key, value);
123 return true;
124 }
125
126 } // namespace net
127