http3: limit size of decompressed headers #5452
Conversation
There was a problem hiding this comment.
Pull Request Overview
This pull request implements size limiting for decompressed HTTP/3 headers to prevent resource exhaustion attacks through highly compressed headers. The implementation follows RFC 9114 section 4.2.2, which specifies that field list size should be calculated based on uncompressed size with a 32-byte overhead per field.
Key changes:
- Added decompressed header size validation in
parseHeaders()that checks size limits during header field iteration - Updated server to send 431 status response when headers exceed limits (both compressed and decompressed)
- Modified error handling to use
ErrCodeExcessiveLoadfor header size violations
Reviewed Changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
http3/headers.go |
Implements decompressed header size checking in parseHeaders() function per RFC 9114 section 4.2.2 |
http3/server.go |
Adds rejectWithStatus() helper and updates error handling to send 431 responses for oversized headers |
http3/stream.go |
Passes maxHeaderBytes limit to updateResponseFromHeaders() for client-side validation |
http3/server_test.go |
Updates test expectations to verify 431 response and ErrCodeExcessiveLoad error code |
http3/headers_test.go |
Updates all test calls to pass math.MaxInt as size limit parameter |
http3/conn.go |
Adds "http3:" prefix to error message for consistency |
integrationtests/self/http_test.go |
Adds comprehensive integration tests for both compressed and decompressed header size limits |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
d555de7 to
f387fc5
Compare
❌ 2 Tests Failed:
View the top 3 failed test(s) by shortest run time
To view more test analytics, go to the Test Analytics Dashboard |
f387fc5 to
0bf8f07
Compare
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Fixes #5429. Fixes #4747.