http: reject responses exceeding header limit

HTTP client parsers continued parsing headers after maxHeadersCount
while omitting excess fields from IncomingMessage. Reject the response
instead so framing headers cannot be hidden from the application.

Assisted-by: Pi
Signed-off-by: Matteo Collina <hello@matteocollina.com>

Author: mcollina

src/node_http_parser.cc

@@ -1040,10 +1040,6 @@ class Parser : public AsyncWrap, public StreamListener {
   }
 
   int TrackHeaderPair() {
-    if (parser_.type != HTTP_REQUEST) {
-      return 0;
-    }
-
     header_pairs_ += 2;
 
     if (max_header_pairs_ < 0) {

test/parallel/test-http-max-headers-count-overflow.js

@@ -32,3 +32,34 @@ server.listen(0, common.mustCall(() => {
     }));
   }));
 }));
+
+function testResponseOverflow(maxHeadersCount) {
+  const max = maxHeadersCount ?? 1000;
+  const responseServer = net.createServer(common.mustCall((socket) => {
+    socket.once('data', common.mustCall(() => {
+      let response = 'HTTP/1.1 200 OK\r\n';
+      for (let i = 0; i < max; i++) {
+        response += `X-${i}: a\r\n`;
+      }
+      socket.end(response +
+                 'Transfer-Encoding: chunked\r\n' +
+                 '\r\n0\r\n\r\n');
+    }));
+  }));
+
+  responseServer.listen(0, common.mustCall(() => {
+    const req = http.get({
+      port: responseServer.address().port,
+    }, common.mustNotCall());
+    if (maxHeadersCount !== undefined) {
+      req.maxHeadersCount = maxHeadersCount;
+    }
+    req.on('error', common.mustCall((err) => {
+      assert.strictEqual(err.code, 'HPE_HEADER_OVERFLOW');
+      responseServer.close();
+    }));
+  }));
+}
+
+testResponseOverflow(2);
+testResponseOverflow();

test/parallel/test-http-max-headers-count.js

@@ -67,7 +67,7 @@ server.maxHeadersCount = max;
 
 server.listen(0, common.mustCall(() => {
   const clientMaxAndExpected = [ // for client
-    [20, 20],
+    [104, 104],
     [1200, 104],
     [0, N + 4], // Host and Connection
   ];

test/parallel/test-https-max-headers-count.js

@@ -56,7 +56,7 @@ server.maxHeadersCount = max;
 
 server.listen(0, common.mustCall(() => {
   const clientMaxAndExpected = [ // for client
-    [20, 20],
+    [104, 104],
     [1200, 104],
     [0, N + 4], // Host and Connection
   ];