Reject leading asterisks on tokens in Draft 09 structured headers.

Draft 09 of the Structured Headers specification (Section 3.9 and Section 4.2.10) requires tokens to begin with an alphabetic character, whereas RFC 8941 (Section 3.3.4) also permits a leading asterisk. Previously, `StructuredHeaderParser::ReadToken` unconditionally allowed a leading asterisk regardless of the parser version, which caused `ParseParameterisedList` to erroneously accept primary identifiers starting with an asterisk.

Restrict leading asterisks in `ReadToken` to `kFinal` (RFC 8941).

PiperOrigin-RevId: 990346076

quiche/common/structured_headers.cc

diff --git a/quiche/common/structured_headers.cc b/quiche/common/structured_headers.cc
index 572e8a8..65ef30c 100644
--- a/quiche/common/structured_headers.cc
+++ b/quiche/common/structured_headers.cc
@@ -374,9 +374,9 @@
 
   // Parses a Token ([SH09] 4.2.10, [RFC8941] 4.2.6).
   std::optional<Item> ReadToken() {
-    if (input_.empty() ||
-        !(absl::ascii_isalpha(input_.front()) || input_.front() == '*')) {
-      LogParseError("ReadToken", "ALPHA");
+    if (input_.empty() || !(absl::ascii_isalpha(input_.front()) ||
+                            (version_ == kFinal && input_.front() == '*'))) {
+      LogParseError("ReadToken", version_ == kDraft09 ? "ALPHA" : "ALPHA | *");
       return std::nullopt;
     }
     size_t len = input_.find_first_not_of(version_ == kDraft09 ? kTokenChars09

quiche/common/structured_headers_test.cc

diff --git a/quiche/common/structured_headers_test.cc b/quiche/common/structured_headers_test.cc
index dc0ed3c..84f13ff 100644
--- a/quiche/common/structured_headers_test.cc
+++ b/quiche/common/structured_headers_test.cc
@@ -433,6 +433,8 @@
       {"extra comma", "abc;a=1,def;b=1,", {}},
       {"leading semicolon", ";abc;a=1", {}},
       {"leading comma", ",abc;a=1", {}},
+      {"leading asterisk", "*abc;a=1", {}},
+      {"non-leading asterisk", "a*bc;a=1", {{Token("a*bc"), {Param("a", 1)}}}},
   };
   for (const auto& c : cases) {
     SCOPED_TRACE(c.name);