test forbidden HTTP/2 headers in reponses

1 files changed, 69 insertions, 0 deletions

diff --git a/test/mitmproxy/proxy/protocol/test_http2.py b/test/mitmproxy/proxy/protocol/test_http2.py
index cede0b80..eec7af89 100644
--- a/test/mitmproxy/proxy/protocol/test_http2.py
+++ b/test/mitmproxy/proxy/protocol/test_http2.py
@@ -272,6 +272,75 @@ class TestSimple(_Http2Test):
 
 
 @requires_alpn
+class TestForbiddenHeaders(_Http2Test):
+
+    @classmethod
+    def handle_server_event(cls, event, h2_conn, rfile, wfile):
+        if isinstance(event, h2.events.ConnectionTerminated):
+            return False
+        elif isinstance(event, h2.events.StreamEnded):
+            import warnings
+            with warnings.catch_warnings():
+                # Ignore UnicodeWarning:
+                # h2/utilities.py:64: UnicodeWarning: Unicode equal comparison
+                # failed to convert both arguments to Unicode - interpreting
+                # them as being unequal.
+                #     elif header[0] in (b'cookie', u'cookie') and len(header[1]) < 20:
+
+                warnings.simplefilter("ignore")
+
+                h2_conn.config.validate_outbound_headers = False
+                h2_conn.send_headers(event.stream_id, [
+                    (':status', '200'),
+                    ('keep-alive', 'foobar'),
+                ])
+            h2_conn.send_data(event.stream_id, b'response body')
+            h2_conn.end_stream(event.stream_id)
+            wfile.write(h2_conn.data_to_send())
+            wfile.flush()
+        return True
+
+    def test_forbidden_headers(self):
+        client, h2_conn = self._setup_connection()
+
+        self._send_request(
+            client.wfile,
+            h2_conn,
+            headers=[
+                (':authority', "127.0.0.1:{}".format(self.server.server.address.port)),
+                (':method', 'GET'),
+                (':scheme', 'https'),
+                (':path', '/'),
+            ])
+
+        done = False
+        while not done:
+            try:
+                raw = b''.join(http2.read_raw_frame(client.rfile))
+                events = h2_conn.receive_data(raw)
+            except exceptions.HttpException:
+                print(traceback.format_exc())
+                assert False
+
+            client.wfile.write(h2_conn.data_to_send())
+            client.wfile.flush()
+
+            for event in events:
+                if isinstance(event, h2.events.ResponseReceived):
+                    assert 'keep-alive' not in event.headers
+                elif isinstance(event, h2.events.StreamEnded):
+                    done = True
+
+        h2_conn.close_connection()
+        client.wfile.write(h2_conn.data_to_send())
+        client.wfile.flush()
+
+        assert len(self.master.state.flows) == 1
+        assert self.master.state.flows[0].response.status_code == 200
+        assert self.master.state.flows[0].response.headers['keep-alive'] == 'foobar'
+
+
+@requires_alpn
 class TestRequestWithPriority(_Http2Test):
 
     @classmethod