net.http: h2 server — reject NUL/CR/LF octets in request field values

RFC 9113 §8.2.1: a field value MUST NOT contain NUL (0x00), LF (0x0a), or CR
(0x0d). The new request validation checked field names but not values, so a value
with an embedded CR/LF was accepted and passed through into req.header — a
malformed request and, if the request were forwarded to an HTTP/1.x peer, a
header-injection / request-smuggling vector. Reject such values (and the same
octets in pseudo-header values) as a stream error.

Found by a requirements-driven review pass (RFC §8.2.1) — not covered by the
h2spec suite. Adds a unit test (CR/LF in a field value -> RST_STREAM).

Co-Authored-By: WOZCODE <contact@withwoz.com>

Author: quaesitor-scientiam

vlib/net/http/h2_server.v

@@ -43,17 +43,34 @@ fn h2_all_digits(s string) bool {
 	return true
 }
 
+// h2_field_value_has_forbidden_octet reports whether a field value contains an
+// octet RFC 9113 §8.2.1 forbids: NUL (0x00), LF (0x0a), or CR (0x0d). Such a
+// value makes the request malformed and, if the request were forwarded to an
+// HTTP/1.x peer, would be a header-injection / request-smuggling vector.
+fn h2_field_value_has_forbidden_octet(value string) bool {
+	for ch in value {
+		if ch == 0 || ch == 0x0a || ch == 0x0d {
+			return true
+		}
+	}
+	return false
+}
+
 // h2_request_field_error returns a non-empty reason when a regular (non-pseudo)
 // request header field is malformed per RFC 9113 §8.2: names must be lowercase
-// and non-empty, connection-specific fields are forbidden, and TE may only carry
-// the value "trailers". An empty return means the field is valid.
+// and non-empty, values must not contain NUL/CR/LF, connection-specific fields
+// are forbidden, and TE may only carry the value "trailers". An empty return
+// means the field is valid.
 fn h2_request_field_error(name string, value string) string {
 	if name.len == 0 {
 		return 'empty header field name'
 	}
 	if name != name.to_lower() {
 		return 'uppercase header field name "${name}"'
 	}
+	if h2_field_value_has_forbidden_octet(value) {
+		return 'forbidden NUL/CR/LF octet in value of "${name}"'
+	}
 	if name in h2_conn_specific_headers {
 		return 'connection-specific header field "${name}"'
 	}
@@ -79,6 +96,9 @@ fn h2_validate_request_pseudo(headers []H2HeaderField) ! {
 			if seen_regular {
 				return error('pseudo-header "${f.name}" after a regular field')
 			}
+			if h2_field_value_has_forbidden_octet(f.value) {
+				return error('forbidden NUL/CR/LF octet in pseudo-header "${f.name}"')
+			}
 			match f.name {
 				':method' {
 					if has_method {

vlib/net/http/h2_server_test.v

@@ -433,6 +433,14 @@ fn test_h2_server_rejects_duplicate_pseudo() {
 	}
 }
 
+// RFC 9113 §8.2.1: a field value containing NUL/CR/LF is malformed (and would be
+// a header-injection vector if forwarded to an HTTP/1.x peer).
+fn test_h2_server_rejects_control_char_in_value() {
+	mut fields := valid_get_pseudo.clone()
+	fields << H2HeaderField{'x-evil', 'a\r\nInjected: 1'}
+	assert_request_malformed(fields, 'CR/LF in field value')
+}
+
 // RFC 9113 §8.3.1: an empty :path pseudo-header is malformed for http/https.
 fn test_h2_server_rejects_empty_path() {
 	fields := [