From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 7 Oct 2026 16:13:42 +0000 (+0200)
Subject: BUG/MINOR: mux-h1: don't forward request trailers named like server name header
X-Git-Tag: v3.5-dev10~132
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=226b8fcb8763fc10a2365a719d54ad8470504e03;p=haproxy.git

BUG/MINOR: mux-h1: don't forward request trailers named like server name header

With "http-send-name-header <name>", the H1 mux skips any request header
with the same name and adds its own with the server's name. But request
trailers were not filtered, so a client sending a chunked request with a
trailer "X-Srv: evil" (with "http-send-name-header X-Srv") had it forwarded
after the "x-srv: s1" header added by haproxy. Servers merging trailers into
the headers may then see the client's value. Let's skip such trailers, like
it is done for headers.

"option http-drop-request-trailers" may be used as a workaround.

This patch could be backported to all supported versions.
---

diff --git a/src/mux_h1.c b/src/mux_h1.c
index 605714c66..3362d54c1 100644
--- a/src/mux_h1.c
+++ b/src/mux_h1.c
@@ -3565,6 +3565,13 @@ static size_t h1_make_trailers(struct h1s *h1s, struct h1m *h1m, struct htx *htx
 			n = htx_get_blk_name(htx, blk);
 			v = htx_get_blk_value(htx, blk);
 
+			/* Skip the trailer if the same name is used to add the
+			 * server name, like it is done for the headers.
+			 */
+			if (!(h1m->flags & H1_MF_RESP) && isttest(h1c->px->server_id_hdr_name) &&
+			    isteqi(n, h1c->px->server_id_hdr_name))
+				goto nextblk;
+
 			if (!h1_format_htx_hdr(n, v, &outbuf, hdrs_map))
 				goto full;
 		}