fix(http2): bound peer-controlled streams and headers

[DubaiChewyCookie]

SETTINGS_MAX_CONCURRENT_STREAMS was only consulted when this endpoint created local streams. A peer could ignore the advertised setting and open unbounded streams, allocating stream state, queues, windows, and controllers.

Enforce the configured peer-initiated stream limit locally before creating Http2StreamImpl. Track active peer streams and locally bound reserved PUSH_PROMISE streams as well. Reject excess streams with RST_STREAM REFUSED_STREAM without publishing them through incomingStreams or peerPushes.

Terminate the connection with GOAWAY ENHANCE_YOUR_CALM after the configured number of consecutive violations. Disabled server push is also enforced on receipt instead of relying on peer compliance or SETTINGS acknowledgement.

Inbound HEADERS and CONTINUATION fragments were accumulated without a size or time bound. Each continuation copied the preceding block again, making fragmented field-block assembly quadratic. HPACK also retained the complete decoded header list before application-level limits could run.

Add the following secure defaults per connection:

• 100 peer-initiated streams
• 16 KiB compressed field block
• 8 KiB decoded field section
• 16 CONTINUATION frames per field block
• 10 second absolute field-block timeout
• 8 consecutive post-acknowledgement stream-limit violations

Start the field-block timer when the initial HEADERS or PUSH_PROMISE frame header is parsed, before its payload is complete. Retain fragments as chunks and combine them once, enforcing compressed-size and CONTINUATION-count limits while the block is received.

Enforce the decoded field-section limit during HPACK processing using name length + value length + 32 bytes per field. Once the limit is crossed, release retained application-visible headers and continue decoding in discard mode so dynamic-table updates remain synchronized.

Reject a completely decoded oversized field section with RST_STREAM ENHANCE_YOUR_CALM and do not publish its headers. Compressed-size, CONTINUATION-count, and timeout violations terminate the connection with GOAWAY ENHANCE_YOUR_CALM because the shared HPACK context cannot safely continue without complete decompression. Invalid HPACK encoding terminates the connection with COMPRESSION_ERROR.

Advertise SETTINGS_MAX_HEADER_LIST_SIZE while enforcing the configured limit locally because the setting is advisory. This also resolves the unbounded buffering TODO introduced by fdaeafb.

Tests cover ACK-independent stream admission, pre-ACK rejection without abuse counting, post-ACK repeated abuse, exact N and N+1 limits, active and reserved stream recovery, disabled push, repeated abuse, compressed and decoded size boundaries, many continuations, slow initial payloads, Huffman and indexed amplification, HPACK dynamic-table synchronization, HEADERS, trailers, and PUSH_PROMISE.

RFC 9113 sections 4.3, 5.1.2, 6.5.2, and 10.5:
https://www.rfc-editor.org/rfc/rfc9113.html

CERT/CC VU#421644:
https://kb.cert.org/vuls/id/421644

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[mosuem]

Can you link an issue this fixes, or provide context on this PR?

[DubaiChewyCookie]

Can you link an issue this fixes, or provide context on this PR?

There is no public issue to link because I originally reported these findings privately through the channel specified by the Dart security policy, using g.co/vulnz. The team reviewing the report confirmed that I could proceed with a public PR directly.

The PR addresses two related per-connection resource-exhaustion issues in package:http2:

1. A remote peer can open more peer-initiated streams than the configured SETTINGS_MAX_CONCURRENT_STREAMS limit, causing unbounded allocation of stream and application state.

   Risk tags: remote DoS · unbounded stream state · per-stream memory amplification · application-work amplification · unenforced peer limits

2. Inbound HEADERS/CONTINUATION blocks have no aggregate size, fragment-count, or receive-time bounds. Their assembly is quadratic, and HPACK decoding can retain a decoded field section much larger than its compressed input.

   Risk tags: remote DoS · unbounded field-block buffering · quadratic fragment assembly · HPACK memory amplification · indexed-header amplification

Both issues are remotely triggerable before application-level limits can reliably reject the work. They are included in the same PR because the fixes share the connection-level admission and header-processing paths.

[mosuem]

Thanks, I'll take a look!

[mosuem]

Nit:

      void processHeader(Header header) {
        headerListSize += header.name.length + header.value.length + 32;
        if (headerListSizeExceeded) return;
        if (maxHeaderListSize != null && headerListSize > maxHeaderListSize) {
          headers.clear();
          headerListSizeExceeded = true;
        } else {
          headers.add(header);
        }
      }

[DubaiChewyCookie]

Applied the suggested simplification.

[mosuem]

It would be great if the doc comments for these default could contain the rationale behind choosing that value - something like a link or quote from the spec, or links to other reference implementations.

[DubaiChewyCookie]

I also compared the proposed defaults against several major HTTP/2 stacks to sanity-check the values and trade-offs.

Limit	Netty 4.1	Jetty 12.1	Apache HttpCore 5	Go x/net/http2	Node.js / nghttp2	Decision
Peer-initiated concurrent streams	100	128 server-side	250	250 server-side	Local SETTINGS default is 2^32-1	100
Decoded header-list size	8 KiB	8 KiB request headers	16,777,215 bytes	About 1 MiB server-side; 10 MiB client-side	65,535 bytes, plus a default 128-field limit	8 KiB
Compressed header-block size	About 10 KiB before GOAWAY	About 8 KiB server parser capacity	No separate fixed limit identified	No fixed aggregate limit; fragments are checked against the remaining decoded budget	No separate public inbound byte limit	16 KiB
Absolute field-block timeout	No dedicated field-block default identified	No dedicated field-block default identified	No dedicated field-block default identified	No dedicated field-block default identified	No dedicated field-block default identified	10 seconds
CONTINUATION frames per block	16 small, non-final fragments	No dedicated count identified	100	No fixed count	8 in nghttp2	16
Consecutive stream-limit violations before GOAWAY	No directly equivalent consecutive threshold identified	No directly equivalent threshold identified	No directly equivalent threshold identified	Excess streams are refused; no equivalent cumulative threshold identified	Similar maxSessionRejectedStreams default of 100	8, but count only after SETTINGS ACK

A few details are important when reading the table:

• These values are not always directly equivalent. Some are advertised HTTP/2 settings, while others are local memory, parser, rate, or abuse limits.
• Node's peerMaxConcurrentStreams = 100 is not equivalent to the inbound limit here. It acts as a pre-SETTINGS assumption about the remote endpoint's advertised limit and therefore applies in the opposite direction.
• Netty's limit of 16 counts only small, non-final CONTINUATION fragments. The Dart limit counts every CONTINUATION frame, regardless of size.
• “No dedicated limit identified” does not mean no protection. Those implementations may rely on general read or idle timeouts, parser byte limits, rate controls, or session memory budgets.
• Go deliberately uses substantially different server and client header-list budgets.
• The Jetty compressed-block figure reflects the request-header limit supplied to its HTTP/2 server parser rather than a separately named compressed-block setting.
• For TypeScript applications, Node's native node:http2 implementation and its nghttp2 dependency are the relevant protocol stack.

[DubaiChewyCookie]

I updated the doc comments with the rationale for all six defaults and the relevant RFC/CERT references.

[mosuem]

I like the previous code references instead of, for example, PUSH_PROMISE.

[DubaiChewyCookie]

Restored in both the class-level and method-level documentation.