Validate converted HTTP/2 headers and trailers

client/src/main/java/org/asynchttpclient/netty/handler/Http2Handler.java

@@ -19,9 +19,11 @@
 import io.netty.channel.Channel;
 import io.netty.channel.ChannelHandler.Sharable;
 import io.netty.channel.ChannelHandlerContext;
-import io.netty.handler.codec.http.DefaultHttpHeaders;
+import io.netty.handler.codec.http.DefaultHttpHeadersFactory;
 import io.netty.handler.codec.http.DefaultHttpResponse;
+import io.netty.handler.codec.http.HttpHeaderNames;
 import io.netty.handler.codec.http.HttpHeaders;
+import io.netty.handler.codec.http.HttpHeadersFactory;
 import io.netty.handler.codec.http.HttpResponse;
 import io.netty.handler.codec.http.HttpResponseStatus;
 import io.netty.handler.codec.http.HttpVersion;
@@ -41,6 +43,7 @@
 import org.asynchttpclient.netty.request.NettyRequestSender;
 
 import java.io.IOException;
+import java.util.Map;
 
 /**
  * HTTP/2 channel handler for stream child channels created by {@link io.netty.handler.codec.http2.Http2MultiplexHandler}.
@@ -56,6 +59,7 @@
 public final class Http2Handler extends AsyncHttpClientHandler {
 
     private static final HttpVersion HTTP_2 = new HttpVersion("HTTP", 2, 0, true);
+    private static final HttpHeadersFactory HEADERS_FACTORY = DefaultHttpHeadersFactory.headersFactory();
 
     public Http2Handler(AsyncHttpClientConfig config, ChannelManager channelManager, NettyRequestSender requestSender) {
         super(config, channelManager, requestSender);
@@ -146,14 +150,7 @@ private void handleHttp2HeadersFrame(Http2HeadersFrame headersFrame, Channel cha
         }
         HttpResponseStatus nettyStatus = HttpResponseStatus.valueOf(statusCode);
 
-        // Build HTTP/1.1-style headers, skipping HTTP/2 pseudo-headers (start with ':')
-        HttpHeaders responseHeaders = new DefaultHttpHeaders();
-        h2Headers.forEach(entry -> {
-            CharSequence name = entry.getKey();
-            if (name.length() > 0 && name.charAt(0) != ':') {
-                responseHeaders.add(name, entry.getValue());
-            }
-        });
+        HttpHeaders responseHeaders = copyHttp2Headers(h2Headers);
 
         // Build a synthetic HttpResponse so the existing interceptor chain can be reused unchanged
         HttpResponse syntheticResponse = new DefaultHttpResponse(HTTP_2, nettyStatus, responseHeaders);
@@ -222,13 +219,7 @@ private void handleHttp2TrailingHeadersFrame(Http2HeadersFrame headersFrame, Cha
                                                   NettyResponseFuture<?> future, AsyncHandler<?> handler) throws Exception {
         Http2Headers h2Headers = headersFrame.headers();
 
-        HttpHeaders trailingHeaders = new DefaultHttpHeaders();
-        h2Headers.forEach(entry -> {
-            CharSequence name = entry.getKey();
-            if (name.length() > 0 && name.charAt(0) != ':') {
-                trailingHeaders.add(name, entry.getValue());
-            }
-        });
+        HttpHeaders trailingHeaders = copyHttp2Trailers(h2Headers);
 
         boolean abort = false;
         if (!trailingHeaders.isEmpty()) {
@@ -240,6 +231,37 @@ private void handleHttp2TrailingHeadersFrame(Http2HeadersFrame headersFrame, Cha
         }
     }
 
+    static HttpHeaders copyHttp2Headers(Http2Headers h2Headers) {
+        return copyHttp2Headers(h2Headers, false);
+    }
+
+    static HttpHeaders copyHttp2Trailers(Http2Headers h2Headers) {
+        return copyHttp2Headers(h2Headers, true);
+    }
+
+    private static HttpHeaders copyHttp2Headers(Http2Headers h2Headers, boolean trailers) {
+        // HTTP/2 validation does not enforce HTTP token syntax or header values, so validate both while converting.
+        HttpHeaders headers = HEADERS_FACTORY.newHeaders();
+        for (Map.Entry<CharSequence, CharSequence> entry : h2Headers) {
+            CharSequence name = entry.getKey();
+            if (name.length() == 0 || name.charAt(0) == ':') {
+                continue;
+            }
+            // The restriction is on the sender; drop prohibited trailers instead of failing after delivering the body.
+            if (trailers && !isPermittedTrailingHeader(name)) {
+                continue;
+            }
+            headers.add(name, entry.getValue());
+        }
+        return headers;
+    }
+
+    private static boolean isPermittedTrailingHeader(CharSequence name) {
+        return !HttpHeaderNames.CONTENT_LENGTH.contentEqualsIgnoreCase(name)
+                && !HttpHeaderNames.TRANSFER_ENCODING.contentEqualsIgnoreCase(name)
+                && !HttpHeaderNames.TRAILER.contentEqualsIgnoreCase(name);
+    }
+
     /**
      * Processes an HTTP/2 RST_STREAM frame, which indicates the server aborted the stream.
      */

client/src/test/java/org/asynchttpclient/netty/handler/Http2HandlerTest.java

@@ -0,0 +1,95 @@
+/*
+ *    Copyright (c) 2026 AsyncHttpClient Project. All rights reserved.
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+package org.asynchttpclient.netty.handler;
+
+import io.netty.handler.codec.http.HttpHeaders;
+import io.netty.handler.codec.http2.DefaultHttp2Headers;
+import io.netty.handler.codec.http2.Http2Headers;
+import org.junit.jupiter.api.Test;
+
+import static io.netty.handler.codec.http.HttpHeaderNames.CONTENT_LENGTH;
+import static io.netty.handler.codec.http.HttpHeaderNames.TRAILER;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class Http2HandlerTest {
+
+    @Test
+    void copiesRegularHeadersAndSkipsPseudoHeaders() {
+        Http2Headers source = new DefaultHttp2Headers(false)
+                .status("200")
+                .add(CONTENT_LENGTH, "5")
+                .add("x-test", "value");
+
+        HttpHeaders copy = Http2Handler.copyHttp2Headers(source);
+
+        assertEquals("5", copy.get(CONTENT_LENGTH));
+        assertEquals("value", copy.get("x-test"));
+        assertFalse(copy.contains(":status"));
+    }
+
+    @Test
+    void rejectsInvalidHeaderNames() {
+        Http2Headers crlf = new DefaultHttp2Headers(false)
+                .add("invalid\r\nname", "value");
+        Http2Headers space = new DefaultHttp2Headers(false)
+                .add("invalid name", "value");
+        Http2Headers parenthesis = new DefaultHttp2Headers(false)
+                .add("invalid(name", "value");
+
+        assertThrows(IllegalArgumentException.class, () -> Http2Handler.copyHttp2Headers(crlf));
+        assertThrows(IllegalArgumentException.class, () -> Http2Handler.copyHttp2Trailers(crlf));
+        assertThrows(IllegalArgumentException.class, () -> Http2Handler.copyHttp2Headers(space));
+        assertThrows(IllegalArgumentException.class, () -> Http2Handler.copyHttp2Trailers(space));
+        assertThrows(IllegalArgumentException.class, () -> Http2Handler.copyHttp2Headers(parenthesis));
+        assertThrows(IllegalArgumentException.class, () -> Http2Handler.copyHttp2Trailers(parenthesis));
+    }
+
+    @Test
+    void skipsEmptyHeaderNames() {
+        Http2Headers source = new DefaultHttp2Headers(false)
+                .add("", "value");
+
+        assertTrue(Http2Handler.copyHttp2Headers(source).isEmpty());
+    }
+
+    @Test
+    void rejectsInvalidHeaderValues() {
+        Http2Headers source = new DefaultHttp2Headers(false)
+                .add("x-test", "value\r\ninjected");
+
+        assertThrows(IllegalArgumentException.class, () -> Http2Handler.copyHttp2Headers(source));
+        assertThrows(IllegalArgumentException.class, () -> Http2Handler.copyHttp2Trailers(source));
+    }
+
+    @Test
+    void dropsProhibitedTrailingHeaders() {
+        Http2Headers source = new DefaultHttp2Headers(false)
+                .status("200")
+                .add("grpc-status", "0")
+                .add(CONTENT_LENGTH, "5")
+                .add(TRAILER, "x-checksum");
+
+        HttpHeaders copy = Http2Handler.copyHttp2Trailers(source);
+
+        assertEquals("0", copy.get("grpc-status"));
+        assertFalse(copy.contains(CONTENT_LENGTH));
+        assertFalse(copy.contains(TRAILER));
+        assertFalse(copy.contains(":status"));
+    }
+}