HttpHeaders should reject negative ContentLength values

spring-web/src/main/java/org/springframework/http/HttpHeaders.java

@@ -969,8 +969,14 @@ public Locale getContentLanguage() {
 	/**
 	 * Set the length of the body in bytes, as specified by the
 	 * {@code Content-Length} header.
+	 * @param contentLength content length (greater than or equal to zero)
+	 * @throws IllegalArgumentException if the content length is negative
+	 * @see <a href="https://www.rfc-editor.org/rfc/rfc2616#section-14.13">RFC 2616, section 14.13</a>
 	 */
 	public void setContentLength(long contentLength) {
+		if (contentLength < 0){
+			throw new IllegalArgumentException("Content-Length must be a non-negative number");
+		}
 		set(CONTENT_LENGTH, Long.toString(contentLength));
 	}
 

spring-web/src/test/java/org/springframework/http/HttpHeadersTests.java

@@ -154,6 +154,18 @@ void contentLength() {
 		assertThat(headers.getFirst("Content-Length")).as("Invalid Content-Length header").isEqualTo("42");
 	}
 
+	@Test
+	void setContentLengthWithNegativeValue() {
+		assertThatIllegalArgumentException().isThrownBy(() ->
+				headers.setContentLength(-1));
+	}
+
+	@Test
+	void getContentLengthReturnsMinusOneForAbsentHeader() {
+		headers.remove(HttpHeaders.CONTENT_LENGTH);
+		assertThat(headers.getContentLength()).isEqualTo(-1);
+	}
+
 	@Test
 	void contentType() {
 		MediaType contentType = new MediaType("text", "html", StandardCharsets.UTF_8);