[net] internal/http3: reject response headers with invalid characters in RoundTrip

0 views

Skip to first unread message

Nicholas Husin (Gerrit)

unread,

Apr 29, 2026, 2:14:31 PM (23 hours ago) Apr 29

to goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Nicholas Husin, Damien Neil, golang...@luci-project-accounts.iam.gserviceaccount.com, golang-co...@googlegroups.com

Nicholas Husin submitted the change

Change information

Commit message:

internal/http3: reject response headers with invalid characters in RoundTrip

Similar to our server implementation, RoundTrip should reject response
headers which contains invalid characters (e.g. uppercase characters and
control characters) when doing QPACK decoding.

For golang/go#70914

Change-Id: Ifa4065b709a30e72ce8a3fa4c64110b36a6a6964

Reviewed-on: https://go-review.googlesource.com/c/net/+/771423

Reviewed-by: Damien Neil <dn...@google.com>

Reviewed-by: Nicholas Husin <hu...@google.com>

LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>

Files:

M http2/http2.go
M internal/http3/qpack.go
M internal/http3/roundtrip.go
M internal/http3/roundtrip_test.go
M internal/http3/server.go

Change size: M

Delta: 5 files changed, 74 insertions(+), 40 deletions(-)

Branch: refs/heads/master

Submit Requirements:

Code-Review: +2 by Damien Neil, +1 by Nicholas Husin
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

open

diffy

satisfied_requirement

Reply all

Reply to author

Forward

0 new messages