Send stream reset on invalid trailer.

Author: ioquatix

lib/async/http/protocol/http2/stream.rb

@@ -64,6 +64,10 @@ def process_headers(frame)
 						if @input and frame.end_stream?
 							@input.close_write
 						end
+					rescue ::Protocol::HTTP::InvalidTrailerError => error
+						Console.warn(self, error)
+						
+						send_reset_stream(::Protocol::HTTP2::Error::PROTOCOL_ERROR)
 					rescue ::Protocol::HTTP2::HeaderError => error
 						Console.debug(self, "Error while processing headers!", error)
 

releases.md

@@ -2,7 +2,7 @@
 
 ## v0.92.2
 
-  - Better handling of trailers.
+  - Better handling of trailers. If invalid trailers are received, the connection (HTTP/1) or stream (HTTP/2) is reset.
 
 ## v0.92.0
 

test/async/http/protocol/http11/invalid_trailer.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+require "async/http/protocol/http2"
+require "async/http/a_protocol"
+
+describe Async::HTTP::Protocol::HTTP11 do
+	include Sus::Fixtures::Async::HTTP::ServerContext
+	
+	let(:protocol) {subject}
+	
+	with "invalid trailers" do
+		let(:app) do
+			Protocol::HTTP::Middleware.for do |request|
+				Protocol::HTTP::Response[200, [], request.body]
+			end
+		end
+		
+		it "rejects host header as trailer" do
+			headers = ::Protocol::HTTP::Headers.new([["host", "example.com"]], 0)
+			
+			body = Async::HTTP::Body::Writable.new
+			
+			response = client.post("/", headers, body)
+			
+			body.write("Hello world!")
+			body.close_write
+			
+			expect do
+				response.read
+			end.to raise_exception(EOFError)
+		end
+	end
+end

test/async/http/protocol/http2/invalid_trailer.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+require "async/http/protocol/http2"
+require "async/http/a_protocol"
+
+describe Async::HTTP::Protocol::HTTP2 do
+	include Sus::Fixtures::Async::HTTP::ServerContext
+	
+	let(:protocol) {subject}
+	
+	with "invalid trailers" do
+		let(:app) do
+			Protocol::HTTP::Middleware.for do |request|
+				Protocol::HTTP::Response[200, [], request.body]
+			end
+		end
+		
+		it "rejects host header as trailer" do
+			headers = ::Protocol::HTTP::Headers.new([["host", "example.com"]], 0)
+			
+			body = Async::HTTP::Body::Writable.new
+			
+			response = client.post("/", headers, body)
+			
+			body.write("Hello world!")
+			body.close_write
+			
+			expect do
+				response.read
+			end.to raise_exception(Protocol::HTTP2::StreamError)
+		end
+	end
+end