api: disallow setting 'host' header directly (#2275)

Description: The ':authority' header is used to direct the connection internally and this is set when initializing the builder.

Fixes #2244.

Risk Level: Low
Testing: Unit

Signed-off-by: Mike Schore <mike.schore@gmail.com>
Signed-off-by: JP Simard <jp@jpsim.com>

mobile/docs/root/intro/version_history.rst

@@ -7,6 +7,7 @@ Pending Release
 Breaking changes:
 
 - api: replace the `drainConnections()` method with a broader `resetConnectivityState()`. (:issue:`#2225 <2225>`).
+- api: disallow setting 'host' header directly (:issue:`#2275 <2275>`)
 - net: enable happy eyeballs by default (:issue:`#2272 <2272>`)
 
 Bugfixes:

mobile/library/kotlin/io/envoyproxy/envoymobile/HeadersBuilder.kt

@@ -77,5 +77,5 @@ open class HeadersBuilder {
   }
 
   private fun isRestrictedHeader(name: String) = name.startsWith(":") ||
-    name.startsWith("x-envoy-mobile")
+    name.startsWith("x-envoy-mobile") || name == "host"
 }

mobile/library/swift/HeadersBuilder.swift

@@ -3,7 +3,7 @@ import Foundation
 private let kRestrictedPrefixes = [":", "x-envoy-mobile"]
 
 private func isRestrictedHeader(name: String) -> Bool {
-  return kRestrictedPrefixes.contains { name.hasPrefix($0) }
+  return name == "host" || kRestrictedPrefixes.contains { name.hasPrefix($0) }
 }
 
 /// Base builder class used to construct `Headers` instances.

mobile/test/kotlin/io/envoyproxy/envoymobile/RequestHeadersBuilderTest.kt

@@ -99,10 +99,12 @@ class RequestHeadersBuilderTest {
     )
       .add(":x-foo", "123")
       .add("x-envoy-mobile-foo", "abc")
+      .add("host", "example.com")
       .build()
 
     assertThat(headers.allHeaders()).doesNotContainKey(":x-foo")
     assertThat(headers.allHeaders()).doesNotContainKey("x-envoy-mobile-foo")
+    assertThat(headers.allHeaders()).doesNotContainKey("host")
   }
 
   @Test

mobile/test/swift/HeadersBuilderTests.swift

@@ -40,6 +40,21 @@ final class HeadersBuilderTests: XCTestCase {
     XCTAssertEqual(["x-foo": ["abc"]], headers)
   }
 
+  func testRestrictedHeadersAreNotSettable() {
+    let headers = RequestHeadersBuilder(method: .get, authority: "example.com", path: "/")
+      .add(name: "host", value: "example.com")
+      .set(name: ":scheme", value: ["http"])
+      .set(name: ":path", value: ["/nope"])
+      .headers
+    let expected = [
+      ":authority": ["example.com"],
+      ":path": ["/"],
+      ":method": ["GET"],
+      ":scheme": ["https"],
+    ]
+    XCTAssertEqual(expected, headers)
+  }
+
   func testBuildersAreEqualIfUnderlyingHeadersAreEqual() {
     let builder1 = RequestHeadersBuilder(headers: ["x-foo": ["123"], "x-bar": ["abc"]])
     let builder2 = RequestHeadersBuilder(headers: ["x-foo": ["123"], "x-bar": ["abc"]])