From bee33c71c9daec52a9d95af7c4d338e5642de69e Mon Sep 17 00:00:00 2001
From: freedom-winds <rodriguezedward6mbmq@gmail.com>
Date: Sun, 16 Aug 2026 23:46:36 +0800
Subject: [PATCH 1/2] fix(http1): reject forbidden trailer fields

---
 src/proto/h1/decode.rs | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/src/proto/h1/decode.rs b/src/proto/h1/decode.rs
index bdfdf79abf..a7a5271539 100644
--- a/src/proto/h1/decode.rs
+++ b/src/proto/h1/decode.rs
@@ -635,7 +635,6 @@ impl ChunkedState {
     }
 }
 
-// TODO: disallow Transfer-Encoding, Content-Length, Trailer, etc in trailers ??
 fn decode_trailers(buf: &mut BytesMut, count: usize) -> Result<HeaderMap, io::Error> {
     let mut trailers = HeaderMap::new();
     let mut headers = vec![httparse::EMPTY_HEADER; count];
@@ -654,6 +653,16 @@ fn decode_trailers(buf: &mut BytesMut, count: usize) -> Result<HeaderMap, io::Er
                     }
                 };
 
+                if name == http::header::CONTENT_LENGTH
+                    || name == http::header::TRANSFER_ENCODING
+                    || name == http::header::TRAILER
+                {
+                    return Err(io::Error::new(
+                        io::ErrorKind::InvalidInput,
+                        format!("Forbidden trailer field: {:?}", &header),
+                    ));
+                }
+
                 let value = match HeaderValue::from_bytes(header.value) {
                     Ok(value) => value,
                     Err(_) => {
@@ -1164,6 +1173,15 @@ mod tests {
         assert_eq!(values, ["first", "second"]);
     }
 
+    #[test]
+    fn test_decode_trailers_rejects_forbidden_fields() {
+        for name in ["Content-Length", "Transfer-Encoding", "Trailer"] {
+            let mut buf = BytesMut::from(format!("{name}: value\r\n\r\n").as_bytes());
+            let err = decode_trailers(&mut buf, 1).expect_err("forbidden trailer field");
+            assert_eq!(err.kind(), io::ErrorKind::InvalidInput);
+        }
+    }
+
     #[tokio::test]
     async fn test_trailer_max_headers_enforced() {
         let h1_max_headers = 10;

From 87edb56fb361190c0bd364d13d4721d5c67db5f8 Mon Sep 17 00:00:00 2001
From: ZT Winds <rodriguezedward6mbmq@gmail.com>
Date: Fri, 21 Aug 2026 19:29:17 +0800
Subject: [PATCH 2/2] test(http1): update trailer fixtures

---
 tests/client.rs | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/tests/client.rs b/tests/client.rs
index b512260cc5..03edfa76da 100644
--- a/tests/client.rs
+++ b/tests/client.rs
@@ -619,7 +619,7 @@ test! {
             5\r\n\
             hello\r\n\
             0\r\n\
-            Trailer: value\r\n\
+            chunky-trailer: value\r\n\
             \r\n\
             ",
 
@@ -650,7 +650,7 @@ test! {
             5\r\n\
             hello\r\n\
             0\r\n\
-            Trailer: value\r\n\
+            chunky-trailer: value\r\n\
             another-trainer: another-value\r\n\
             \r\n\
             ",
@@ -833,9 +833,6 @@ test! {
             chunky-trailer4: header data4\r\n\
             chunky-trailer5: header data5\r\n\
             sneaky-trailer: not in trailer header\r\n\
-            transfer-encoding: chunked\r\n\
-            content-length: 5\r\n\
-            trailer: foo\r\n\
             \r\n\
             ",
 
@@ -860,9 +857,6 @@ test! {
                 "chunky-trailer4" => "header data4",
                 "chunky-trailer5" => "header data5",
                 "sneaky-trailer" => "not in trailer header",
-                "transfer-encoding" => "chunked",
-                "content-length" => "5",
-                "trailer" => "foo",
             },
 }