[go] net/http/internal/http2: reject STREAM_ENDED + Content-Length request

1 view

Skip to first unread message

Gopher Robot (Gerrit)

unread,

May 13, 2026, 4:05:23 PM (3 days ago) May 13

to Brad Fitzpatrick, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Damien Neil, Nicholas Husin, Nicholas Husin, golang...@luci-project-accounts.iam.gserviceaccount.com, golang-co...@googlegroups.com

Gopher Robot submitted the change

Change information

Commit message:

net/http/internal/http2: reject STREAM_ENDED + Content-Length request

We silently accepted HEADERS with END_STREAM and non-zero
"content-length" header set, meaning no DATA frames will follow.

The Handler saw ContentLength == 0 and EOF instead of rejecting the
malformed request.

Change-Id: I01e3ec3bddc4cc6c43f8bcdcfa40b0dd7d9d7f55

Reviewed-on: https://go-review.googlesource.com/c/go/+/777180

Reviewed-by: Nicholas Husin <n...@golang.org>

Reviewed-by: Damien Neil <dn...@google.com>

Auto-Submit: Damien Neil <dn...@google.com>

LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>

Reviewed-by: Nicholas Husin <hu...@google.com>

Files:

M src/net/http/internal/http2/server.go
M src/net/http/internal/http2/server_test.go

Change size: S

Delta: 2 files changed, 25 insertions(+), 7 deletions(-)

Branch: refs/heads/master

Submit Requirements:

Code-Review: +1 by Nicholas Husin, +2 by Nicholas Husin, +2 by Damien Neil
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

open

diffy

satisfied_requirement

Reply all

Reply to author

Forward

0 new messages