http3: reject header field that contain non-lowercase characters (#3964)

http3/request.go

@@ -2,6 +2,7 @@ package http3
 
 import (
 	"errors"
+	"fmt"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -15,6 +16,10 @@ func requestFromHeaders(headers []qpack.HeaderField) (*http.Request, error) {
 
 	httpHeaders := http.Header{}
 	for _, h := range headers {
+		// field names need to be lowercase, see section 4.2 of RFC 9114
+		if strings.ToLower(h.Name) != h.Name {
+			return nil, fmt.Errorf("header field is not lower-case: %s", h.Name)
+		}
 		switch h.Name {
 		case ":path":
 			path = h.Value

http3/request_test.go

@@ -33,6 +33,17 @@ var _ = Describe("Request", func() {
 		Expect(req.RequestURI).To(Equal("/foo"))
 	})
 
+	It("rejects upper-case fields", func() {
+		headers := []qpack.HeaderField{
+			{Name: ":path", Value: "/foo"},
+			{Name: ":authority", Value: "quic.clemente.io"},
+			{Name: ":method", Value: "GET"},
+			{Name: "Content-Length", Value: "42"},
+		}
+		_, err := requestFromHeaders(headers)
+		Expect(err).To(MatchError("header field is not lower-case: Content-Length"))
+	})
+
 	It("parses path with leading double slashes", func() {
 		headers := []qpack.HeaderField{
 			{Name: ":path", Value: "//foo"},