1731522 - HTTP/2 header name CRLF injection

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Takeshi Terada]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36

Steps to reproduce:

Unlike http/1.1, HTTP/2 header name can contain CRLF by its encoding syntax.

If the following response headers (represented in JSON key-value pairs) are returned from HTTP/2 server, Firefox saves "hello" cookie probably because Firefox internally place them into http/1.1 message without header name validation.

{
  'aaa:aaa\r\nset-cookie:hello=111;path=/;': 'vvv',
  date: 'Mon, 20 Sep 2021 05:30:02 GMT'
}

Chrome, Safari and IE raise error when given response header name or value contains CR or LF. I guess this is the behavior expected by RFC 7540 section 10.3.

Comment 1

[Takeshi Terada]

Sorry. This bug is fixed in Firefox 93.

HTTP headers with spaces in the name in HTTP2 should send ERR_HTTP2_PROTOCOL_ERROR
https://bugzilla.mozilla.org/show_bug.cgi?id=1663836

Comment 2

[Kershaw Chang [:kershaw]]

(In reply to Takeshi Terada from comment #1)

Sorry. This bug is fixed in Firefox 93.

HTTP headers with spaces in the name in HTTP2 should send ERR_HTTP2_PROTOCOL_ERROR
https://bugzilla.mozilla.org/show_bug.cgi?id=1663836

Yes, I think this is fixed.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Can we get a rating on this bug? Do we need to backport bug 1663836 to ESR91?

Comment 4

[Kershaw Chang [:kershaw]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #3)

Can we get a rating on this bug? Do we need to backport bug 1663836 to ESR91?

I think this bug is not really serious, since we already have this flaw for a while.
It'd be good to backport bug 1663836 to ESR, since it's a simple fix and should not cause any regression.
I'll ask Manual to do this.