HTTP/2 Check header names in HeaderCoalescer

net/spdy/header_coalescer.cc

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/header_coalescer.h"
 
 #include <utility>
 
 #include "base/strings/string_util.h"
 #include "net/spdy/platform/api/spdy_estimate_memory_usage.h"
 
 namespace net {
 
 const size_t kMaxHeaderListSize = 256 * 1024;
 
 void HeaderCoalescer::OnHeader(base::StringPiece key, base::StringPiece value) {
   if (error_seen_) {
     return;
   }
 
   if (key.empty()) {
     DVLOG(1) << "Header name must not be empty.";
     error_seen_ = true;
     return;
   }
 
+  // RFC 7540 Section 8.1.2 says that header field names are ASCII characters.
+  if (!base::IsStringASCII(key)) {

[asanka, 2017/02/22 19:44:13]

Consider using something like HttpUtil::IsValidHeaderName(). RFC 7540 prescribes
an additional restriction where the header name should be lowercase.

[xunjieli, 2017/02/22 20:14:51]

Done. Thanks for the suggestion!

+    error_seen_ = true;
+    return;
+  }
+
   // 32 byte overhead according to RFC 7540 Section 6.5.2.
   header_list_size_ += key.size() + value.size() + 32;
   if (header_list_size_ > kMaxHeaderListSize) {
     error_seen_ = true;
     return;
   }
 
   if (key[0] == ':') {
     if (regular_header_seen_) {
       error_seen_ = true;
@@ skipping 32 matching lines @@
   DCHECK(headers_valid_);
   headers_valid_ = false;
   return std::move(headers_);
 }
 
 size_t HeaderCoalescer::EstimateMemoryUsage() const {
   return SpdyEstimateMemoryUsage(headers_);
 }
 
 }  // namespace net