Require http or https scheme for now in incoming requests.

http2.go

@@ -446,7 +446,8 @@ func (sc *serverConn) processHeaderBlockFragment(streamID uint32, frag []byte, e
 		// TODO: convert to stream error I assume?
 		return err
 	}
-	if sc.invalidHeader || sc.method == "" || sc.path == "" || sc.scheme == "" {
+	if sc.invalidHeader || sc.method == "" || sc.path == "" ||
+		(sc.scheme != "https" && sc.scheme != "http") {
 		// See 8.1.2.6 Malformed Requests and Responses:
 		//
 		// Malformed requests or responses that are detected

http2_test.go

@@ -410,6 +410,10 @@ func TestServer_Request_Reject_Pseudo_Missing_scheme(t *testing.T) {
 	testRejectRequest(t, func(st *serverTester) { st.bodylessReq1(":scheme", "") })
 }
 
+func TestServer_Request_Reject_Pseudo_scheme_invalid(t *testing.T) {
+	testRejectRequest(t, func(st *serverTester) { st.bodylessReq1(":scheme", "bogus") })
+}
+
 func TestServer_Request_Reject_Pseudo_Unknown(t *testing.T) {
 	testRejectRequest(t, func(st *serverTester) { st.bodylessReq1(":unknown_thing", "") })
 }