nghttpx: In mruby, the first header is always deleted on every call to env.req.set_header(...)

[dylanplecki]

A bug in the nghttpx mruby code has been stripping all of our HTTP/2 request headers when a certain mruby script was enabled. This script called env.req.set_header("HEADER", "") multiple (10+ times) in order to strip-away insecure headers before passing the request internally. The bug that we observed was that all headers were being stripped away, regardless of whether they were in a set_header directive or not.

The offending bug is in the src/shrpx_mruby_module_request.cc file, in the request_mod_header function, and only occurs when repl == true. This is due to a simple logic error in the header replacement code, which will always truncate the headers list by removing the first header.

A pull request with the fix is ready and will be attached momentarily.