fix(mitm): filter response headers

Author: blakebyrnes

mitm/handlers/HeadersHandler.ts

@@ -3,6 +3,7 @@ import nodeCommon from '_http_common';
 import IResourceHeaders from '@secret-agent/core-interfaces/IResourceHeaders';
 import Log from '@secret-agent/commons/Logger';
 import * as http from 'http';
+import http2 from 'http2';
 import { parseRawHeaders } from '../lib/Utils';
 import IMitmRequestContext from '../interfaces/IMitmRequestContext';
 
@@ -93,7 +94,11 @@ export default class HeadersHandler {
       if (nodeCommon._checkInvalidHeaderChar(value)) continue;
 
       if (Array.isArray(value)) {
-        headers[canonizedKey] = [...value];
+        if (singleValueHttp2Headers.has(key)) {
+          headers[canonizedKey] = value[0];
+        } else {
+          headers[canonizedKey] = [...value];
+        }
       } else {
         headers[canonizedKey] = value;
       }
@@ -139,6 +144,10 @@ export default class HeadersHandler {
       if (stripHttp1HeadersForH2.includes(lowerKey)) {
         delete ctx.requestHeaders[key];
       }
+      if (singleValueHttp2Headers.has(lowerKey)) {
+        const value = ctx.requestHeaders[key];
+        if (Array.isArray(value) && value.length) ctx.requestHeaders[key] = value[0];
+      }
     }
   }
 
@@ -157,11 +166,58 @@ export default class HeadersHandler {
 }
 
 const stripHttp1HeadersForH2 = [
-  'connection',
+  http2.constants.HTTP2_HEADER_CONNECTION,
+  http2.constants.HTTP2_HEADER_UPGRADE,
+  http2.constants.HTTP2_HEADER_HTTP2_SETTINGS,
+  http2.constants.HTTP2_HEADER_KEEP_ALIVE,
+  http2.constants.HTTP2_HEADER_PROXY_CONNECTION,
+  http2.constants.HTTP2_HEADER_TRANSFER_ENCODING,
   'host',
-  'keep-alive',
-  'transfer-encoding',
   'via',
-  'proxy-connection',
   'forwarded',
 ];
+// This set contains headers that are permitted to have only a single
+// value. Multiple instances must not be specified.
+// NOTE: some are not exposed in constants, so we're putting strings in place
+const singleValueHttp2Headers = new Set([
+  http2.constants.HTTP2_HEADER_STATUS,
+  http2.constants.HTTP2_HEADER_METHOD,
+  http2.constants.HTTP2_HEADER_AUTHORITY,
+  http2.constants.HTTP2_HEADER_SCHEME,
+  http2.constants.HTTP2_HEADER_PATH,
+  ':protocol',
+  'access-control-allow-credentials',
+  'access-control-max-age',
+  'access-control-request-method',
+  http2.constants.HTTP2_HEADER_AGE,
+  http2.constants.HTTP2_HEADER_AUTHORIZATION,
+  http2.constants.HTTP2_HEADER_CONTENT_ENCODING,
+  http2.constants.HTTP2_HEADER_CONTENT_LANGUAGE,
+  http2.constants.HTTP2_HEADER_CONTENT_LENGTH,
+  http2.constants.HTTP2_HEADER_CONTENT_LOCATION,
+  http2.constants.HTTP2_HEADER_CONTENT_MD5,
+  http2.constants.HTTP2_HEADER_CONTENT_RANGE,
+  http2.constants.HTTP2_HEADER_CONTENT_TYPE,
+  http2.constants.HTTP2_HEADER_DATE,
+  'dnt',
+  http2.constants.HTTP2_HEADER_ETAG,
+  http2.constants.HTTP2_HEADER_EXPIRES,
+  http2.constants.HTTP2_HEADER_FROM,
+  http2.constants.HTTP2_HEADER_HOST,
+  http2.constants.HTTP2_HEADER_IF_MATCH,
+  http2.constants.HTTP2_HEADER_IF_MODIFIED_SINCE,
+  http2.constants.HTTP2_HEADER_IF_NONE_MATCH,
+  http2.constants.HTTP2_HEADER_IF_RANGE,
+  http2.constants.HTTP2_HEADER_IF_UNMODIFIED_SINCE,
+  http2.constants.HTTP2_HEADER_LAST_MODIFIED,
+  http2.constants.HTTP2_HEADER_LOCATION,
+  http2.constants.HTTP2_HEADER_MAX_FORWARDS,
+  http2.constants.HTTP2_HEADER_PROXY_AUTHORIZATION,
+  http2.constants.HTTP2_HEADER_RANGE,
+  http2.constants.HTTP2_HEADER_REFERER,
+  http2.constants.HTTP2_HEADER_RETRY_AFTER,
+  'tk',
+  'upgrade-insecure-requests',
+  http2.constants.HTTP2_HEADER_USER_AGENT,
+  'x-content-type-options',
+]);

mitm/package.json

@@ -15,6 +15,7 @@
     "@types/node-forge": "^0.9.5",
     "@types/ws": "^7.2.4",
     "http-proxy-agent": "^4.0.1",
+    "agent-base": "4.3.0",
     "proxy": "^1.0.1",
     "ws": "^7.3.0"
   }

yarn.lock

@@ -3826,7 +3826,7 @@ address@^1.1.0, address@^1.1.2:
   resolved "https://registry.yarnpkg.com/address/-/address-1.1.2.tgz#bf1116c9c758c51b7a933d296b72c221ed9428b6"
   integrity sha512-aT6camzM4xEA54YVJYSqxz1kv4IHnQZRtThJJHhUMRExaU5spC7jX5ugSwTaTgJliIgs4VhZOk7htClvQ/LmRA==
 
-agent-base@4, agent-base@^4.3.0:
+agent-base@4, agent-base@4.3.0, agent-base@^4.3.0:
   version "4.3.0"
   resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-4.3.0.tgz#8165f01c436009bccad0b1d122f05ed770efc6ee"
   integrity sha512-salcGninV0nPrwpGNn4VTXBb1SOuXQBiqbrNXoeizJsHrsL6ERFM2Ne3JUSBWRE6aeNJI2ROP/WEEIDUiDe3cg==