curl_quiche: refuse headers with CR, LF or null bytes

[bagder]

Also renamed the struct field to 'h1hdr' from 'scratch' to better say what its purpose is.

[Copilot]

Pull request overview

This PR adds security validation to refuse HTTP/3 headers containing CR, LF, or null bytes, and improves code clarity by renaming the scratch field to h1hdr to better reflect its purpose as a buffer for HTTP/1-style header construction.

Key Changes:

• Introduced fineh3header() validation function to check header values for invalid characters (CR, LF, null)
• Renamed struct field scratch to h1hdr throughout the codebase for better clarity
• Added validation check before processing regular headers

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bagder]

augment review

[augmentcode]

🤖 Augment PR Summary

Summary: Hardens curl’s quiche-based HTTP/3 response header handling by rejecting header fields containing CR/LF/NUL, preventing unsafe HTTP/1-style header reconstruction.

Changes:

• Rename the temporary header construction buffer from scratch to h1hdr for clarity
• Add is_valid_h3_header() to detect CR, LF, and NUL bytes in header names/values
• Validate :status before decoding and synthesizing the HTTP/3 ...\r\n status line
• Only emit HTTP/1-formatted header lines for name/value pairs that pass validation; otherwise log and ignore

Technical Notes: This change reduces the risk of header injection or parser confusion when converting HTTP/3 headers into HTTP/1-like lines for downstream processing.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestions posted.

Comment augment review to trigger a new review at any time.