11import testing
2- from memory import Span
3- from lightbug_http.strings import (
4- validate_http_message_octets,
5- safe_to_string_rfc9112,
6- to_string_rfc9112_safe,
7- is_us_ascii_octet,
8- is_iso_8859_1_octet,
9- percent_encode_invalid_octets,
10- )
11- from lightbug_http.io.bytes import Bytes, ByteReader
12- from lightbug_http.http.request import HTTPRequest
13-
14-
15- def test_rfc9112_lf_security_vulnerability_prevention ():
16- """ RFC 9112 Section 2.2-2: Prevent security vulnerabilities from LF (%x 0A) in multibyte sequences."""
17- print (" Testing: LF security vulnerability prevention..." )
18-
19- # Valid LF in HTTP context
20- var valid_http = " GET /test HTTP/1.1\r\n Host: test.com\r\n\r\n "
21- var valid_octets = valid_http.as_bytes()
22-
23- try :
24- var validated = validate_http_message_octets(Span(valid_octets))
25- testing.assert_equal(len (validated), len (valid_octets))
26- except e:
27- testing.assert_true(False , " Valid HTTP message should not raise error: " + String(e))
28-
29- # Invalid multibyte sequence containing LF
30- var malicious_bytes = List[UInt8]()
31- malicious_bytes.extend(" GET /" .as_bytes())
32- malicious_bytes.append(0x C0 ) # Invalid UTF-8 start byte
33- malicious_bytes.append(0x 0A ) # LF embedded in multibyte sequence
34- malicious_bytes.append(0x 80 ) # Continuation byte
35- malicious_bytes.extend(" HTTP/1.1\r\n Host: test.com\r\n\r\n " .as_bytes())
36-
37- var malicious_span = Span(malicious_bytes)
38-
39- try :
40- var validated = validate_http_message_octets(malicious_span)
41- testing.assert_true(False , " Should have rejected invalid multibyte sequence with embedded LF" )
42- except e:
43- testing.assert_true(True , " Correctly rejected invalid sequence: " + String(e))
44-
45- var safe_result = to_string_rfc9112_safe(malicious_span)
46-
47- testing.assert_true(safe_result.find(" %" ) != - 1 , " Should percent-encode unsafe sequences" )
48-
49-
50- def test_rfc9112_percent_encoding_fallback ():
51- """ RFC 9112 Section 2.2-2: Test percent-encoding fallback for unsafe sequences."""
52- print (" Testing: Percent-encoding fallback for unsafe sequences..." )
53-
54- var unsafe_bytes = List[UInt8]()
55- unsafe_bytes.append(0x 00 ) # NULL byte
56- unsafe_bytes.append(0x 0A ) # LF
57- unsafe_bytes.append(0x 0D ) # CR
58- unsafe_bytes.append(0x 25 ) # % (should be encoded)
59- unsafe_bytes.append(0x FF ) # High byte
60-
61- var unsafe_span = Span(unsafe_bytes)
62- var encoded = percent_encode_invalid_octets(unsafe_span)
63-
64- testing.assert_true(encoded.find(" %00" ) != - 1 , " Should encode NULL byte" )
65- testing.assert_true(encoded.find(" %0A" ) != - 1 , " Should encode LF" )
66- testing.assert_true(encoded.find(" %0D" ) != - 1 , " Should encode CR" )
67- testing.assert_true(encoded.find(" %25" ) != - 1 , " Should encode % c haracter" )
68- testing.assert_true(encoded.find(" %F F" ) != - 1 , " Should encode high byte" )
692
703
714def main ():
725 print (" 🧪 Testing RFC 9112 Section 2.2-2: HTTP Message Parsing as Octets" )
736
74- test_rfc9112_lf_security_vulnerability_prevention()
75- test_rfc9112_percent_encoding_fallback()
767
778 print (" \n ✅ RFC 9112 Section 2.2-2 requirement fully verified" )
0 commit comments