quic: validate :path in sendHeaders

Reject invalid :path values before passing headers to nghttp3.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>

Author: Archkon

lib/internal/quic/quic.js

@@ -19,6 +19,7 @@ const {
   PromiseResolve,
   PromiseWithResolvers,
   SafeSet,
+  String,
   Symbol,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
@@ -2065,6 +2066,14 @@ class QuicStream {
         'The negotiated QUIC application protocol does not support headers');
     }
     validateObject(headers, 'headers');
+    const path = headers[':path'];
+    if (path !== undefined) {
+      const value = String(path);
+      if (value[0] !== '/' && value !== '*') {
+        throw new ERR_INVALID_ARG_VALUE(
+          'headers.:path', path, 'must start with "/"');
+      }
+    }
     const { terminal = false } = options;
     const headerString = buildNgHeaderString(
       headers, assertValidPseudoHeader, true /* strictSingleValueFields */);

test/parallel/test-quic-h3-header-validation.mjs

@@ -78,17 +78,18 @@ const decoder = new TextDecoder();
   });
   await clientSession.opened;
 
+  const requestHeaders = {
+    // Mixed-case names — should be lowercased by buildNgHeaderString.
+    ':method': 'GET',
+    ':path': '/test',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+    'X-Custom-Header': 'Value1',
+    'Content-Type': 'text/plain',
+    'X-Mixed-Case': 'MixedValue',
+  };
+
   const stream = await clientSession.createBidirectionalStream({
-    headers: {
-      // Mixed-case names — should be lowercased by buildNgHeaderString.
-      ':method': 'GET',
-      ':path': '/test',
-      ':scheme': 'https',
-      ':authority': 'localhost',
-      'X-Custom-Header': 'Value1',
-      'Content-Type': 'text/plain',
-      'X-Mixed-Case': 'MixedValue',
-    },
     onheaders: mustCall(function(headers) {
       // Client should also receive lowercased response header names.
       assert.strictEqual(headers[':status'], '200');
@@ -103,6 +104,13 @@ const decoder = new TextDecoder();
     }),
   });
 
+  assert.throws(() => stream.sendHeaders({
+    ...requestHeaders,
+    ':path': 'testwtpath',
+  }), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.strictEqual(
+    stream.sendHeaders(requestHeaders, { terminal: true }), true);
+
   const body = await bytes(stream);
   assert.strictEqual(decoder.decode(body), 'ok');
   await Promise.all([stream.closed, serverDone.promise]);