From cc561cc5a70a43eb9fd6b4f64f5263b10ee4124c Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 10 Aug 2018 11:05:57 -0700
Subject: [PATCH] http2: explicitly disallow nested push streams

Fixes: https://github.com/nodejs/node/issues/19095

Backport-PR-URL: https://github.com/nodejs/node/pull/22850
PR-URL: https://github.com/nodejs/node/pull/22245
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
---
 doc/api/errors.md                              | 6 ++++++
 doc/api/http2.md                               | 3 +++
 lib/internal/errors.js                         | 2 ++
 lib/internal/http2/core.js                     | 2 ++
 test/parallel/test-http2-server-push-stream.js | 8 ++++++++
 5 files changed, 21 insertions(+)

diff --git a/doc/api/errors.md b/doc/api/errors.md
index 13193f95ca9af8..8632bb7be28484 100755
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -775,6 +775,12 @@ required to send an acknowledgment that it has received and applied the new
 be sent at any given time. This error code is used when that limit has been
 reached.
 
+<a id="ERR_HTTP2_NESTED_PUSH"></a>
+### ERR_HTTP2_NESTED_PUSH
+
+An attempt was made to initiate a new push stream from within a push stream.
+Nested push streams are not permitted.
+
 <a id="ERR_HTTP2_NO_SOCKET_MANIPULATION"></a>
 ### ERR_HTTP2_NO_SOCKET_MANIPULATION
 
diff --git a/doc/api/http2.md b/doc/api/http2.md
index 3da544420077dc..cd4edbc6c89214 100644
--- a/doc/api/http2.md
+++ b/doc/api/http2.md
@@ -1261,6 +1261,9 @@ Setting the weight of a push stream is not allowed in the `HEADERS` frame. Pass
 a `weight` value to `http2stream.priority` with the `silent` option set to
 `true` to enable server-side bandwidth balancing between concurrent streams.
 
+Calling `http2stream.pushStream()` from within a pushed stream is not permitted
+and will throw an error.
+
 #### http2stream.respond([headers[, options]])
 <!-- YAML
 added: v8.4.0
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index d216e9c37cf0b0..587fce65613374 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -321,6 +321,8 @@ E('ERR_HTTP2_INVALID_SETTING_VALUE',
 E('ERR_HTTP2_INVALID_STREAM', 'The stream has been destroyed');
 E('ERR_HTTP2_MAX_PENDING_SETTINGS_ACK',
   (max) => `Maximum number of pending settings acknowledgements (${max})`);
+E('ERR_HTTP2_NESTED_PUSH',
+  'A push stream cannot initiate another push stream.', Error);
 E('ERR_HTTP2_NO_SOCKET_MANIPULATION',
   'HTTP/2 sockets should not be directly manipulated (e.g. read and written)');
 E('ERR_HTTP2_OUT_OF_STREAMS',
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
index e496c3a87fd3ee..2dea50ea065556 100644
--- a/lib/internal/http2/core.js
+++ b/lib/internal/http2/core.js
@@ -2116,6 +2116,8 @@ class ServerHttp2Stream extends Http2Stream {
   pushStream(headers, options, callback) {
     if (!this.pushAllowed)
       throw new errors.Error('ERR_HTTP2_PUSH_DISABLED');
+    if (this[kID] % 2 === 0)
+      throw new errors.Error('ERR_HTTP2_NESTED_PUSH');
 
     const session = this[kSession];
 
diff --git a/test/parallel/test-http2-server-push-stream.js b/test/parallel/test-http2-server-push-stream.js
index 6ac10cae77f951..69e74349475c42 100644
--- a/test/parallel/test-http2-server-push-stream.js
+++ b/test/parallel/test-http2-server-push-stream.js
@@ -22,6 +22,14 @@ server.on('stream', common.mustCall((stream, headers) => {
         'x-push-data': 'pushed by server',
       });
       push.end('pushed by server data');
+
+      common.expectsError(() => {
+        push.pushStream({}, common.mustNotCall());
+      }, {
+        code: 'ERR_HTTP2_NESTED_PUSH',
+        type: Error
+      });
+
       stream.end('test');
     }));
   }