[MM-16437] Plugin crashes the server when calling WriteHeader with an invalid http code (#11276)

* [MM-16437] add a check so that we don't write an invalid header

* better solution

* * passing in the logger; logging the error; fixed a spelling mistake

* trigger jenkins

plugin/client_rpc.go

@@ -286,8 +286,8 @@ func (g *hooksRPCClient) ServeHTTP(c *Context, w http.ResponseWriter, r *http.Re
 		defer connection.Close()
 
 		rpcServer := rpc.NewServer()
-		if err := rpcServer.RegisterName("Plugin", &httpResponseWriterRPCServer{w: w}); err != nil {
-			g.log.Error("Plugin failed to ServeHTTP, coulden't register RPC name", mlog.Err(err))
+		if err := rpcServer.RegisterName("Plugin", &httpResponseWriterRPCServer{w: w, log: g.log}); err != nil {
+			g.log.Error("Plugin failed to ServeHTTP, couldn't register RPC name", mlog.Err(err))
 			return
 		}
 		rpcServer.ServeConn(connection)

plugin/http.go

@@ -4,13 +4,18 @@
 package plugin
 
 import (
+	"errors"
+	"fmt"
 	"io"
 	"net/http"
 	"net/rpc"
+
+	"github.com/mattermost/mattermost-server/mlog"
 )
 
 type httpResponseWriterRPCServer struct {
-	w http.ResponseWriter
+	w   http.ResponseWriter
+	log *mlog.Logger
 }
 
 func (w *httpResponseWriterRPCServer) Header(args struct{}, reply *http.Header) error {
@@ -24,6 +29,12 @@ func (w *httpResponseWriterRPCServer) Write(args []byte, reply *struct{}) error
 }
 
 func (w *httpResponseWriterRPCServer) WriteHeader(args int, reply *struct{}) error {
+	// Check if args is a valid http status code. This prevents plugins from crashing the server with a panic.
+	// This is a copy of the checkWriteHeaderCode function in net/http/server.go in the go source.
+	if args < 100 || args > 999 {
+		w.log.Error(fmt.Sprintf("Plugin tried to write an invalid http status code: %v. Did not write the invalid header.", args))
+		return errors.New("invalid http status code")
+	}
 	w.w.WriteHeader(args)
 	return nil
 }