Reject client enable-push settings (#1318)

Co-authored-by: Miro <200482516+Mirochill@users.noreply.github.com>

Author: Mirochill

CHANGELOG.rst

@@ -27,6 +27,7 @@ dev
 **Bugfixes**
 
 - Fix to allow sending 0 bytes on a stream even if the flow control window is negative.
+- Reject non-zero ``SETTINGS_ENABLE_PUSH`` values received from servers.
 
 4.3.0 (2025-08-23)
 ------------------

src/h2/connection.py

@@ -1777,6 +1777,8 @@ def _receive_settings_frame(self, frame: SettingsFrame) -> tuple[list[Frame], li
             return [], events
 
         # Add the new settings.
+        for setting, value in frame.settings.items():
+            self.remote_settings.validate_received_setting(setting, value)
         self.remote_settings.update(frame.settings)
         events.append(
             RemoteSettingsChanged.from_settings(

src/h2/settings.py

@@ -126,6 +126,8 @@ class Settings(MutableMapping[SettingCodes | int, int]):
     """
 
     def __init__(self, client: bool = True, initial_values: dict[SettingCodes, int] | None = None) -> None:
+        self._client = client
+
         # Backing object for the settings. This is a dictionary of
         # (setting: [list of values]), where the first value in the list is the
         # current value of the setting. Strictly this doesn't use lists but
@@ -287,6 +289,23 @@ def __setitem__(self, key: SettingCodes | int, value: int) -> None:
 
         items.append(value)
 
+    def validate_received_setting(self, setting: SettingCodes | int, value: int) -> None:
+        """
+        Validate a setting received from the peer that owns this Settings
+        object.
+
+        Servers may advertise ``ENABLE_PUSH`` only as ``0`` in received
+        SETTINGS frames.
+        """
+        invalid = _validate_setting(setting, value, client=self._client)
+
+        if invalid != ErrorCodes.NO_ERROR:
+            msg = f"Setting {setting} has invalid value {value}"
+            raise InvalidSettingsValueError(
+                msg,
+                error_code=invalid,
+            )
+
     def __delitem__(self, key: SettingCodes | int) -> None:
         del self._settings[key]
 
@@ -311,13 +330,23 @@ def __ne__(self, other: object) -> bool:
     __hash__ = MutableMapping.__hash__
 
 
-def _validate_setting(setting: SettingCodes | int, value: int) -> ErrorCodes:
+def _validate_setting(
+    setting: SettingCodes | int,
+    value: int,
+    *,
+    client: bool | None = None,
+) -> ErrorCodes:
     """
     Confirms that a specific setting has a well-formed value. If the setting is
     invalid, returns an error code. Otherwise, returns 0 (NO_ERROR).
+
+    If ``client`` is set, the setting originated from a peer with that role.
     """
     if setting == SettingCodes.ENABLE_PUSH:
-        if value not in (0, 1):
+        # RFC 9113 section 6.5.2: "A client MUST treat receipt of a
+        # SETTINGS frame with SETTINGS_ENABLE_PUSH set to 1 as a connection
+        # error (Section 5.4.1) of type PROTOCOL_ERROR."
+        if value not in (0, 1) or (client is False and value != 0):
             return ErrorCodes.PROTOCOL_ERROR
     elif setting == SettingCodes.INITIAL_WINDOW_SIZE:
         if not 0 <= value <= 2147483647:  # 2^31 - 1

tests/test_invalid_frame_sequences.py

@@ -10,6 +10,7 @@
 import h2.errors
 import h2.events
 import h2.exceptions
+import h2.settings
 
 
 class TestInvalidFrameSequences:
@@ -266,6 +267,23 @@ def test_reject_invalid_settings_values(self, frame_factory, settings) -> None:
             h2.errors.ErrorCodes.PROTOCOL_ERROR
         )
 
+    def test_reject_server_enable_push_updates(self, frame_factory) -> None:
+        """
+        Clients reject servers that advertise non-zero SETTINGS_ENABLE_PUSH
+        values in received SETTINGS frames.
+        """
+        c = h2.connection.H2Connection(config=self.client_config)
+        c.initiate_connection()
+
+        f = frame_factory.build_settings_frame(
+            settings={h2.settings.SettingCodes.ENABLE_PUSH: 1},
+        )
+
+        with pytest.raises(h2.exceptions.InvalidSettingsValueError) as e:
+            c.receive_data(f.serialize())
+
+        assert e.value.error_code == h2.errors.ErrorCodes.PROTOCOL_ERROR
+
     @pytest.mark.parametrize("request_headers", [example_request_headers, example_request_headers_bytes])
     def test_invalid_frame_headers_are_protocol_errors(self, frame_factory, request_headers) -> None:
         """