Skip to content

HTTP/2: tighten SETTINGS validation #632

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arturobernalg merged 1 commit into from
Feb 22, 2026
Merged

HTTP/2: tighten SETTINGS validation #632

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 4 additions & 7 deletions httpcore5-h2/src/main/java/org/apache/hc/core5/http2/config/H2Config.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,14 +179,12 @@ public Builder setPushEnabled(final boolean pushEnabled) {
}

public Builder setMaxConcurrentStreams(final int maxConcurrentStreams) {
Args.positive(maxConcurrentStreams, "Max concurrent streams");
this.maxConcurrentStreams = maxConcurrentStreams;
this.maxConcurrentStreams = Args.checkRange(maxConcurrentStreams, 0, Integer.MAX_VALUE, "Max concurrent streams");
return this;
}

public Builder setInitialWindowSize(final int initialWindowSize) {
Args.positive(initialWindowSize, "Initial window size");
this.initialWindowSize = initialWindowSize;
this.initialWindowSize = Args.checkRange(initialWindowSize, 0, Integer.MAX_VALUE, "Initial window size");
return this;
}

Expand All @@ -197,8 +195,7 @@ public Builder setMaxFrameSize(final int maxFrameSize) {
}

public Builder setMaxHeaderListSize(final int maxHeaderListSize) {
Args.positive(maxHeaderListSize, "Max header list size");
this.maxHeaderListSize = maxHeaderListSize;
this.maxHeaderListSize = Args.checkRange(maxHeaderListSize, 0, Integer.MAX_VALUE, "Max header list size");
return this;
}

Expand All @@ -214,7 +211,7 @@ public Builder setCompressionEnabled(final boolean compressionEnabled) {
* @since 5,4
*/
public Builder setMaxContinuations(final int maxContinuations) {
Args.positive(maxContinuations, "Max continuations");
Args.notNegative(maxContinuations, "Max continuations");
this.maxContinuations = maxContinuations;
return this;
}
Expand Down
9 changes: 7 additions & 2 deletions httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/ClientH2StreamMultiplexer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,8 +104,13 @@ public ClientH2StreamMultiplexer(

@Override
void validateSetting(final H2Param param, final int value) throws H2ConnectionException {
if (param == H2Param.ENABLE_PUSH && value == 1) {
throw new H2ConnectionException(H2Error.PROTOCOL_ERROR, "Illegal ENABLE_PUSH setting");
if (param == H2Param.ENABLE_PUSH) {
if (value != 0 && value != 1) {
throw new H2ConnectionException(H2Error.PROTOCOL_ERROR, "Illegal ENABLE_PUSH setting: " + value);
}
if (value == 1) {
throw new H2ConnectionException(H2Error.PROTOCOL_ERROR, "Illegal ENABLE_PUSH setting");
}
}
}

Expand Down
5 changes: 5 additions & 0 deletions httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/ServerH2StreamMultiplexer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,11 @@ public ServerH2StreamMultiplexer(

@Override
void validateSetting(final H2Param param, final int value) throws H2ConnectionException {
if (param == H2Param.ENABLE_PUSH) {
if (value != 0 && value != 1) {
throw new H2ConnectionException(H2Error.PROTOCOL_ERROR, "Illegal ENABLE_PUSH setting: " + value);
}
}
}

@Override
Expand Down
28 changes: 26 additions & 2 deletions ...e5-h2/src/test/java/org/apache/hc/core5/http2/impl/nio/TestClientH2StreamMultiplexer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,13 +60,35 @@ private ClientH2StreamMultiplexer newMultiplexer() {
}

@Test
void validateSettingRejectsEnablePush() {
void validateSettingRejectsEnablePush1OnClient() {
final ClientH2StreamMultiplexer multiplexer = newMultiplexer();
final H2ConnectionException ex = Assertions.assertThrows(H2ConnectionException.class, () ->
multiplexer.validateSetting(H2Param.ENABLE_PUSH, 1));
Assertions.assertEquals(H2Error.PROTOCOL_ERROR.getCode(), ex.getCode());
}

@Test
void validateSettingAcceptsEnablePush0OnClient() throws Exception {
final ClientH2StreamMultiplexer multiplexer = newMultiplexer();
multiplexer.validateSetting(H2Param.ENABLE_PUSH, 0);
}

@Test
void validateSettingRejectsEnablePush2OnClient() {
final ClientH2StreamMultiplexer multiplexer = newMultiplexer();
final H2ConnectionException ex = Assertions.assertThrows(H2ConnectionException.class, () ->
multiplexer.validateSetting(H2Param.ENABLE_PUSH, 2));
Assertions.assertEquals(H2Error.PROTOCOL_ERROR.getCode(), ex.getCode());
}

@Test
void validateSettingRejectsEnablePushNegativeOnClient() {
final ClientH2StreamMultiplexer multiplexer = newMultiplexer();
final H2ConnectionException ex = Assertions.assertThrows(H2ConnectionException.class, () ->
multiplexer.validateSetting(H2Param.ENABLE_PUSH, -1));
Assertions.assertEquals(H2Error.PROTOCOL_ERROR.getCode(), ex.getCode());
}

@Test
void acceptHeaderFrameRejected() {
final ClientH2StreamMultiplexer multiplexer = newMultiplexer();
Expand Down Expand Up @@ -95,7 +117,9 @@ void incomingRequestRejected() {
void outgoingPushPromiseRejected() {
final ClientH2StreamMultiplexer multiplexer = newMultiplexer();
Assertions.assertThrows(H2ConnectionException.class, () ->
multiplexer.outgoingPushPromise(Mockito.mock(H2StreamChannel.class), Mockito.mock(AsyncPushProducer.class)));
multiplexer.outgoingPushPromise(
Mockito.mock(H2StreamChannel.class),
Mockito.mock(AsyncPushProducer.class)));
}

@Test
Expand Down
32 changes: 31 additions & 1 deletion ...e5-h2/src/test/java/org/apache/hc/core5/http2/impl/nio/TestServerH2StreamMultiplexer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
import org.apache.hc.core5.http2.H2ConnectionException;
import org.apache.hc.core5.http2.H2Error;
import org.apache.hc.core5.http2.config.H2Config;
import org.apache.hc.core5.http2.config.H2Param;
import org.apache.hc.core5.http2.frame.DefaultFrameFactory;
import org.apache.hc.core5.reactor.ProtocolIOSession;
import org.junit.jupiter.api.Assertions;
Expand All @@ -59,6 +60,34 @@ private ServerH2StreamMultiplexer newMultiplexer() {
null);
}

@Test
void validateSettingAcceptsEnablePush0OnServer() throws Exception {
final ServerH2StreamMultiplexer multiplexer = newMultiplexer();
multiplexer.validateSetting(H2Param.ENABLE_PUSH, 0);
}

@Test
void validateSettingAcceptsEnablePush1OnServer() throws Exception {
final ServerH2StreamMultiplexer multiplexer = newMultiplexer();
multiplexer.validateSetting(H2Param.ENABLE_PUSH, 1);
}

@Test
void validateSettingRejectsEnablePush2OnServer() {
final ServerH2StreamMultiplexer multiplexer = newMultiplexer();
final H2ConnectionException ex = Assertions.assertThrows(H2ConnectionException.class, () ->
multiplexer.validateSetting(H2Param.ENABLE_PUSH, 2));
Assertions.assertEquals(H2Error.PROTOCOL_ERROR.getCode(), ex.getCode());
}

@Test
void validateSettingRejectsEnablePushNegativeOnServer() {
final ServerH2StreamMultiplexer multiplexer = newMultiplexer();
final H2ConnectionException ex = Assertions.assertThrows(H2ConnectionException.class, () ->
multiplexer.validateSetting(H2Param.ENABLE_PUSH, -1));
Assertions.assertEquals(H2Error.PROTOCOL_ERROR.getCode(), ex.getCode());
}

@Test
void acceptPushFrameRejected() {
final ServerH2StreamMultiplexer multiplexer = newMultiplexer();
Expand All @@ -73,7 +102,8 @@ void outgoingRequestRejected() {
final HandlerFactory<AsyncPushConsumer> pushHandlerFactory =
(HandlerFactory<AsyncPushConsumer>) Mockito.mock(HandlerFactory.class);
Assertions.assertThrows(H2ConnectionException.class, () ->
multiplexer.outgoingRequest(Mockito.mock(H2StreamChannel.class),
multiplexer.outgoingRequest(
Mockito.mock(H2StreamChannel.class),
Mockito.mock(AsyncClientExchangeHandler.class),
pushHandlerFactory,
null));
Expand Down
Loading