Fish 9690 filtering incorrect characters from header rfc 9110

[breakponchito]

This is a PR to include new properties on the grizzly implementation to enable Header Name and Header Value validation against invalid characters mentioned on the RFC-9110, here the reference of the reported issue: Glassfish issue and here the reserved CVE CVE-2024-45687

To test this set the dependency version on the payara server: 2.3.31.payara-p5 build and run
deploy the following reproducer:
MinimalTest.zip

By default grizzly is setting two new properties that enable the validation of the headers by default. You can customize this behavior by seeting the following properties from UI or by cli command o directly on the domain.xml file

• -Dorg.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110=true
• -Dorg.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110=true

asadmin create-jvm-options --target=server-config "-Dorg.glassfish.grizzly.http.STRICT_HEADER_NAME_VALIDATION_RFC_9110\=true"

asadmin create-jvm-options --target=server-config "-Dorg.glassfish.grizzly.http.STRICT_HEADER_VALUE_VALIDATION_RFC_9110\=true"

after adding the properties you need to restart the server

by default on the grizzly side those properties are set as true

deploy the reproducer and make curl calls

Header Name Validation tests:

• curl -i -v -H $'X-MyHeader\n: hello' http://localhost:8080/MinimalTest/
• curl -i -v -H $'X-MyHeader\r: hello' http://localhost:8080/MinimalTest/

the result of any of those test should be error 400:

The following request will return 200 but the \0 will be removed and not accepted :

• curl -i -v -H $'X-MyHeader\0: hello' http://localhost:8080/MinimalTest/

Header Value Validations tests:

• curl -i -v -H $'X-MyHeader: he\nllo' http://localhost:8080/MinimalTest/

• curl -i -v -H $'X-MyHeader: he\rllo' http://localhost:8080/MinimalTest/
  

• curl -i -v -H $'X-MyHeader: he\0llo' http://localhost:8080/MinimalTest/
  

The \0 is immediately not processed from curl because by default we can't consider that character on the request headers and the the \r and \n characters are not permitted alone on the header value content