Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| HttpResponseStatus nettyStatus = HttpResponseStatus.valueOf(statusCode); | ||
|
|
||
| // Build HTTP/1.1-style headers, skipping HTTP/2 pseudo-headers (start with ':') | ||
| HttpHeaders responseHeaders = new DefaultHttpHeaders(false); |
Check warning
Code scanning / CodeQL
Disabled Netty HTTP header validation Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 16 hours ago
In general, the fix is to re‑enable Netty’s built‑in header validation so that CRLF and other illegal characters in header names/values are rejected. This is done by using the default DefaultHttpHeaders() constructor (which enables validation) or by passing true instead of false to the existing constructor.
For this specific instance in client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java, the safest and most straightforward change is to replace new DefaultHttpHeaders(false) with new DefaultHttpHeaders(). This keeps the existing behavior (building a mutable HttpHeaders from HTTP/2 headers and passing it into DefaultHttpResponse) while adding Netty’s validation step. No other logic needs to change: iteration over h2Headers, filtering out pseudo‑headers, and subsequent interceptor handling all remain the same. No new imports or helper methods are required, because DefaultHttpHeaders is already imported.
Concretely:
- In
handleHttp2HeadersFrame, on the line whereresponseHeadersis declared, change the constructor call fromnew DefaultHttpHeaders(false)tonew DefaultHttpHeaders(). - Leave the rest of the method intact, including how
syntheticResponseis constructed and howresponseHeadersis passed around.
| @@ -104,7 +104,7 @@ | ||
| HttpResponseStatus nettyStatus = HttpResponseStatus.valueOf(statusCode); | ||
|
|
||
| // Build HTTP/1.1-style headers, skipping HTTP/2 pseudo-headers (start with ':') | ||
| HttpHeaders responseHeaders = new DefaultHttpHeaders(false); | ||
| HttpHeaders responseHeaders = new DefaultHttpHeaders(); | ||
| h2Headers.forEach(entry -> { | ||
| CharSequence name = entry.getKey(); | ||
| if (name.length() > 0 && name.charAt(0) != ':') { |
1 participant
No description provided.