1
1
import testing
2
- from memory import Span
3
- from lightbug_http.strings import (
4
- validate_http_message_octets,
5
- safe_to_string_rfc9112,
6
- to_string_rfc9112_safe,
7
- is_us_ascii_octet,
8
- is_iso_8859_1_octet,
9
- percent_encode_invalid_octets,
10
- )
11
- from lightbug_http.io.bytes import Bytes, ByteReader
12
- from lightbug_http.http.request import HTTPRequest
13
-
14
-
15
- def test_rfc9112_lf_security_vulnerability_prevention ():
16
- """ RFC 9112 Section 2.2-2: Prevent security vulnerabilities from LF (%x 0A) in multibyte sequences."""
17
- print (" Testing: LF security vulnerability prevention..." )
18
-
19
- # Valid LF in HTTP context
20
- var valid_http = " GET /test HTTP/1.1\r\n Host: test.com\r\n\r\n "
21
- var valid_octets = valid_http.as_bytes()
22
-
23
- try :
24
- var validated = validate_http_message_octets(Span(valid_octets))
25
- testing.assert_equal(len (validated), len (valid_octets))
26
- except e:
27
- testing.assert_true(False , " Valid HTTP message should not raise error: " + String(e))
28
-
29
- # Invalid multibyte sequence containing LF
30
- var malicious_bytes = List[UInt8]()
31
- malicious_bytes.extend(" GET /" .as_bytes())
32
- malicious_bytes.append(0x C0 ) # Invalid UTF-8 start byte
33
- malicious_bytes.append(0x 0A ) # LF embedded in multibyte sequence
34
- malicious_bytes.append(0x 80 ) # Continuation byte
35
- malicious_bytes.extend(" HTTP/1.1\r\n Host: test.com\r\n\r\n " .as_bytes())
36
-
37
- var malicious_span = Span(malicious_bytes)
38
-
39
- try :
40
- var validated = validate_http_message_octets(malicious_span)
41
- testing.assert_true(False , " Should have rejected invalid multibyte sequence with embedded LF" )
42
- except e:
43
- testing.assert_true(True , " Correctly rejected invalid sequence: " + String(e))
44
-
45
- var safe_result = to_string_rfc9112_safe(malicious_span)
46
-
47
- testing.assert_true(safe_result.find(" %" ) != - 1 , " Should percent-encode unsafe sequences" )
48
-
49
-
50
- def test_rfc9112_percent_encoding_fallback ():
51
- """ RFC 9112 Section 2.2-2: Test percent-encoding fallback for unsafe sequences."""
52
- print (" Testing: Percent-encoding fallback for unsafe sequences..." )
53
-
54
- var unsafe_bytes = List[UInt8]()
55
- unsafe_bytes.append(0x 00 ) # NULL byte
56
- unsafe_bytes.append(0x 0A ) # LF
57
- unsafe_bytes.append(0x 0D ) # CR
58
- unsafe_bytes.append(0x 25 ) # % (should be encoded)
59
- unsafe_bytes.append(0x FF ) # High byte
60
-
61
- var unsafe_span = Span(unsafe_bytes)
62
- var encoded = percent_encode_invalid_octets(unsafe_span)
63
-
64
- testing.assert_true(encoded.find(" %00" ) != - 1 , " Should encode NULL byte" )
65
- testing.assert_true(encoded.find(" %0A" ) != - 1 , " Should encode LF" )
66
- testing.assert_true(encoded.find(" %0D" ) != - 1 , " Should encode CR" )
67
- testing.assert_true(encoded.find(" %25" ) != - 1 , " Should encode % c haracter" )
68
- testing.assert_true(encoded.find(" %F F" ) != - 1 , " Should encode high byte" )
69
2
70
3
71
4
def main ():
72
5
print (" 🧪 Testing RFC 9112 Section 2.2-2: HTTP Message Parsing as Octets" )
73
6
74
- test_rfc9112_lf_security_vulnerability_prevention()
75
- test_rfc9112_percent_encoding_fallback()
76
7
77
8
print (" \n ✅ RFC 9112 Section 2.2-2 requirement fully verified" )
0 commit comments