[ruby/net-http] Validate header key and field value length in set_field

The length limits only ran in initialize_http_header, which responses
bypass: each_response_header builds the response through add_field and
set_field, so an oversized response header field was never bounded. Check
the field value length in set_field and append_field_value, and fold the
key length check into validate_field_name so set_field and
initialize_http_header share one place for validating field names.

ruby/net-http@ab084fdc0c

Co-authored-by: Yusuke Endoh <mame@ruby-lang.org>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

lib/net/http/header.rb

@@ -193,12 +193,9 @@ def initialize_http_header(initheader) #:nodoc:
         warn "net/http: nil HTTP header: #{key}", uplevel: 3 if $VERBOSE
       else
         value = value.strip # raise error for invalid byte sequences
-        if key.to_s.bytesize > MAX_KEY_LENGTH
-          raise ArgumentError, "too long (#{key.bytesize} bytes) header: #{key[0, 30].inspect}..."
-        end
         validate_field_name(key)
         if value.to_s.bytesize > MAX_FIELD_LENGTH
-          raise ArgumentError, "header #{key} has too long field value: #{value.bytesize}"
+          raise ArgumentError, "header #{key} has too long field value: #{value.bytesize} bytes (limit #{MAX_FIELD_LENGTH})"
         end
         if value.count("\r\n") > 0
           raise ArgumentError, "header #{key} has field value #{value.inspect}, this cannot include CR/LF"
@@ -264,14 +261,17 @@ def []=(key, val)
   def add_field(key, val)
     stringified_downcased_key = key.downcase.to_s
     if @header.key?(stringified_downcased_key)
-      append_field_value(@header[stringified_downcased_key], val)
+      append_field_value(@header[stringified_downcased_key], val, key)
     else
       set_field(key, val)
     end
   end
 
   # :stopdoc:
   private def validate_field_name(key)
+    if key.to_s.bytesize > MAX_KEY_LENGTH
+      raise ArgumentError, "too long (#{key.to_s.bytesize} bytes) header: #{key.to_s[0, 30].inspect}..."
+    end
     if /[\x00-\x1f\x7f:]/n.match?(key.to_s.b)
       raise ArgumentError, "header field name cannot include control characters or colon: #{key.to_s[0, 30].inspect}"
     end
@@ -282,23 +282,29 @@ def add_field(key, val)
     case val
     when Enumerable
       ary = []
-      append_field_value(ary, val)
+      append_field_value(ary, val, key)
       @header[key.downcase.to_s] = ary
     else
       val = val.to_s # for compatibility use to_s instead of to_str
+      if val.bytesize > MAX_FIELD_LENGTH
+        raise ArgumentError, "header #{key} has too long field value: #{val.bytesize} bytes (limit #{MAX_FIELD_LENGTH})"
+      end
       if val.b.count("\r\n") > 0
         raise ArgumentError, 'header field value cannot include CR/LF'
       end
       @header[key.downcase.to_s] = [val]
     end
   end
 
-  private def append_field_value(ary, val)
+  private def append_field_value(ary, val, key)
     case val
     when Enumerable
-      val.each{|x| append_field_value(ary, x)}
+      val.each{|x| append_field_value(ary, x, key)}
     else
       val = val.to_s
+      if val.bytesize > MAX_FIELD_LENGTH
+        raise ArgumentError, "header #{key} has too long field value: #{val.bytesize} bytes (limit #{MAX_FIELD_LENGTH})"
+      end
       if /[\r\n]/n.match?(val.b)
         raise ArgumentError, 'header field value cannot include CR/LF'
       end

test/net/http/test_httpheader.rb

@@ -89,6 +89,24 @@ def test_ASET
     assert_raise(ArgumentError){ @c['foo'] = ["a\nb"] }
   end
 
+  def test_set_field_too_long_key
+    assert_raise(ArgumentError){ @c['x' * (Net::HTTPHeader::MAX_KEY_LENGTH + 1)] = 'a' }
+    assert_nothing_raised{ @c['x' * Net::HTTPHeader::MAX_KEY_LENGTH] = 'a' }
+  end
+
+  def test_set_field_too_long_value
+    long = 'a' * (Net::HTTPHeader::MAX_FIELD_LENGTH + 1)
+    assert_raise(ArgumentError){ @c['foo'] = long }
+    assert_raise(ArgumentError){ @c['foo'] = [long] }
+    assert_raise(ArgumentError){ @c.add_field 'foo', long }
+
+    # the error message names the key and the limit on every path
+    @c['foo'] = 'ok'
+    e = assert_raise(ArgumentError){ @c.add_field 'foo', long }
+    assert_match(/foo/, e.message)
+    assert_match(/#{Net::HTTPHeader::MAX_FIELD_LENGTH}/, e.message)
+  end
+
   def test_AREF
     @c['My-Header'] = 'test string'
     assert_equal 'test string', @c['my-header']