Bound the number of http headers and query parameters per message

[chenBright]

What problem does this PR solve?

Issue Number: resolve

Problem Summary:

CaseIgnoredHasher (headers) and DefaultHasher (query map) are both plain
result = result * 101 + c with no per-process seed, and FlatMap picks a
bucket by masking the low bits of the hash. An attacker only needs the low
log2(nbucket) bits to match, which is brute-forceable offline in seconds and
reusable against every process, since nothing is seeded.

Both maps then degrade to a single chain:

• on_header_value() calls GetOrAddHeader() for every field, so each header
  costs a linear scan of the chain built so far. The cost is on the lookup side
  and is paid unconditionally on the parse hot path.
• URI::ParseQueries() inserts through FlatMap::operator[], which walks the
  chain to dedup. The cost is on the insert side.

Either one turns a single request into O(n^2) work in the server's IO path.
Nothing bounded n: h1 had no field-count limit at all, and h2's
max_header_list_size bounds the decoded bytes of a header block, not the
number of fields in it.

What is changed and the side effects?

Changed:

Tomcat's maxHeaderCount, Envoy's max_request_headers_count, PHP's
max_input_vars, Django's DATA_UPLOAD_MAX_NUMBER_FIELDS and
Tomcat 11's maxParameterCount, all of which were introduced as hashDoS
mitigations.

Therefore, two flags are introduced to bound the number of http headers and
query parameters per message:

• -http_max_header_count (default 100), checked in
  HttpMessage::on_header_value() for h1 and in
  H2StreamContext::ConsumeHeaders() after AppendHeader() for h2.

• -http_max_query_count (default 1000), checked in URI::SetHttpURL() for h1
  and in URI::SetH2Path() for h2. It counts & separators rather than map
  entries: the splitter walks every segment even when the keys repeat, and it is
  that walk the limit is meant to bound.

Setting flag to <= 0 lifts the limit.

Side effects:

• Performance effects:

• Breaking backward compatibility:

---

Check List:

• Please make sure your changes are compilable.
• When providing us with a new feature, it is best to add related tests.
• Please follow Contributor Covenant Code of Conduct.

[Copilot]

🟡 Changes recommended

It introduces an ABI-breaking public API change (URI::SetH2Path return type) that should be avoided or redesigned to preserve compatibility.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds HashDoS mitigations in bRPC’s HTTP parsing path by bounding the number of stored HTTP header entries and the number of query segments processed per message, and it introduces/extends unit tests to validate the new limits for both HTTP/1 and HTTP/2 parsing.

Changes:

• Add http_max_header_count enforcement during HTTP/1 header parsing and HTTP/2 header consumption.
• Add http_max_query_count enforcement for URL query parsing in both SetHttpURL and SetH2Path, with new tests for limit/disable behavior.
• Add new unit tests covering over-limit cases for headers and queries, plus some minor test robustness adjustments.

File summaries

File	Description
test/brpc_uri_unittest.cpp	Adds unit tests for the new query-parameter count limit and disabled-limit behavior.
test/brpc_http_rpc_protocol_unittest.cpp	Adds HTTP/2 tests for header-count and :path query-count limits; minor assert/test robustness tweaks.
test/brpc_http_message_unittest.cpp	Adds HTTP/1 parsing tests for header-count limits and folding/non-folding behavior.
src/brpc/uri.h	Changes URI::SetH2Path API to return int and document failure via status().
src/brpc/uri.cpp	Introduces http_max_query_count flag and enforces query segment limits in URL parsing.
src/brpc/socket.cpp	Initializes _http_request_method in Socket::OnCreated.
src/brpc/policy/http2_rpc_protocol.cpp	Enforces header-count limit in HTTP/2 and handles SetH2Path failure.
src/brpc/details/http_message.cpp	Introduces http_max_header_count flag and enforces it during HTTP/1 header parsing.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

It introduces a source-breaking public API change (URI::SetH2Path) and the new HTTP/2 limit failures currently escalate to connection-level GOAWAY behavior rather than isolating the offending stream.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

src/brpc/uri.h:104

• Changing URI::SetH2Path from void to int in a public header is a source-breaking API change for any downstream code that calls SetH2Path() and ignores a return value. Since the only new failure mode is already captured by URI::status(), consider keeping the original void signature and reporting errors via status() (or adding a new method with a different name that returns int) so existing callers keep compiling.

    // Returns 0 on success, -1 otherwise and status() is set.
    int SetH2Path(const char* h2_path);
    int SetH2Path(const std::string& path) { return SetH2Path(path.c_str()); }

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The limits are enforced in the intended hot paths with appropriate HTTP/2 stream-level rejection semantics and are backed by focused unit tests for both H1 and H2 behaviors.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 0 new
• Review effort level: Lite

[chenBright]

Rebase master to resolve conflict.