From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Thu, 22 Oct 2026 15:28:38 +0000 (+0200)
Subject: BUG/MAJOR: h3: always check :path for all scheme values
X-Git-Tag: v3.5-dev10~68
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=78c2c9956fd8fd65fe6a3da6d36a10c3d5f3f43e;p=haproxy.git

BUG/MAJOR: h3: always check :path for all scheme values

Update HTTP/3 parser so that :path pseudo-header is always checked to
reject any invalid values.

Previously, this was only performed if scheme is HTTPS or HTTP.
HAProxy's HTTP/3 is only associated with an HTTP-compatible protocol on
the other side, so removes the unnecessary condition before verifying
path conformity.

This must be backported up to 2.6.
---

diff --git a/src/h3.c b/src/h3.c
index ccbb28bbf..ab49739ba 100644
--- a/src/h3.c
+++ b/src/h3.c
@@ -948,9 +948,14 @@ static ssize_t h3_req_headers_to_htx(struct qcs *qcs, const struct buffer *buf,
 	 * 0x2a) for the :path pseudo-header field; see Section 7.1 of
 	 * [HTTP].
 	 */
-	if ((isteqi(scheme, ist("http")) || isteqi(scheme, ist("https"))) &&
-	    (!istlen(path) ||
-	     (istptr(path)[0] != '/' && !isteq(path, ist("*"))))) {
+
+	/* HAProxy only works with HTTP(S)-like schemes, always check path no
+	 * matter what the value of :scheme is. Reject empty paths or value not
+	 * started with '/' or '*'. This is important to prevent any issues
+	 * related to URI concatenation.
+	 */
+	if (!istlen(path) ||
+	    (istptr(path)[0] != '/' && !isteq(path, ist("*")))) {
 		TRACE_ERROR("invalid ':path' pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
 		h3s->err = H3_ERR_MESSAGE_ERROR;
 		qcc_report_glitch(h3c->qcc, 1);