Description Line breaks are forbidden in HTTP header values. When a response header set by XWiki or by an extension contains one, the result depends on the protocol:
- Over HTTP/1.1 and AJP, Tomcat replaces the control characters by spaces, so nobody notices.
- Over HTTP/2 (RFC 9113, section 8.2.1), Tomcat sends them unchanged and browsers reject the whole response: Chrome fails the request with ERR_HTTP2_PROTOCOL_ERROR, Firefox closes the whole connection with a GOAWAY (NS_ERROR_NET_HTTP2_SENT_GOAWAY), which also aborts the other requests in flight.
XWIKI-25202 was such a case: the X-XWIKI-HTML-HEAD header contained line breaks, so the page tabs failed to load over HTTP/2. It was fixed at the source, but any other code (core, extensions, scripts using $response.setHeader) can make the same mistake, and the bug only shows up on installations that serve HTTP/2 from the servlet container. Proposed change Add a servlet filter, mapped to all requests in web.xml next to SafeRedirectFilter and ResolveRelativeRedirectFilter, which wraps the response and replaces line breaks (\r, \n) by spaces in setHeader and addHeader. This makes the behaviour the same for all protocols, and covers all entry points (actions, resource handlers, REST). Installations with a customized web.xml only get it if they add the filter themselves. |
