BUG/MINOR: mux-h1: don't forward request trailers named like server name header

With "http-send-name-header <name>", the H1 mux skips any request header
with the same name and adds its own with the server's name. But request
trailers were not filtered, so a client sending a chunked request with a
trailer "X-Srv: evil" (with "http-send-name-header X-Srv") had it forwarded
after the "x-srv: s1" header added by haproxy. Servers merging trailers into
the headers may then see the client's value. Let's skip such trailers, like
it is done for headers.

"option http-drop-request-trailers" may be used as a workaround.

This patch could be backported to all supported versions.

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 605714c66cdb886f8683ed11e2428874e19976a9..3362d54c1108f4b25647f49b6dd10da3afe2a3f3 100644 (file)
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -3565,6 +3565,13 @@ static size_t h1_make_trailers(struct h1s *h1s, struct h1m *h1m, struct htx *htx
                        n = htx_get_blk_name(htx, blk);
                        v = htx_get_blk_value(htx, blk);
 
+                       /* Skip the trailer if the same name is used to add the
+                        * server name, like it is done for the headers.
+                        */
+                       if (!(h1m->flags & H1_MF_RESP) && isttest(h1c->px->server_id_hdr_name) &&
+                           isteqi(n, h1c->px->server_id_hdr_name))
+                               goto nextblk;
+
                        if (!h1_format_htx_hdr(n, v, &outbuf, hdrs_map))
                                goto full;
                }