Harden operator-set target headers (closes #233) (#242)

internal/delivery/target_headers.go

@@ -65,6 +65,11 @@ func isReservedTargetHeader(name string) bool {
 		// the configured headers, so a configured one would always
 		// be overwritten.
 		return true
+	case "Trailer":
+		// net/http strips Trailer from the request it writes
+		// (reqWriteExcludeHeader), so a configured one is accepted
+		// and stored and then provably never reaches the wire.
+		return true
 	default:
 		return false
 	}
@@ -118,9 +123,11 @@ func parseHeaderLine(line string) (string, string, error) {
 
 	rawName = strings.TrimSpace(rawName)
 	if !validHeaderName(rawName) {
-		return "", "", fmt.Errorf(
-			"%w: %q", errHeaderNameInvalid, rawName,
-		)
+		// Quotes nothing. The text before the first colon is only
+		// a name if it parses as one; when it does not, it is as
+		// likely to be a pasted value whose own colon split the
+		// line, and half of a token would be echoed into the 400.
+		return "", "", errHeaderNameInvalid
 	}
 
 	name := http.CanonicalHeaderKey(rawName)