Skip to content

Commit a78dc6b

Browse files
MDA2AVMDA2AV
authored
Merge pull request #73 from MDA2AV/feature/add-tests
Add 2 new tests - COMP-RANGE-POST COMP-UPGRADE-HTTP10
2 parents b656f41 + bc9d6be commit a78dc6b

5 files changed

Lines changed: 146 additions & 2 deletions

File tree

‎docs/content/compliance/_index.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,14 +56,15 @@ Each test sends a request that violates a specific **MUST** or **MUST NOT** requ
5656
'COMP-POST-CL-UNDERSEND','COMP-CHUNKED-BODY','COMP-CHUNKED-MULTI',
5757
'COMP-CHUNKED-EMPTY','COMP-CHUNKED-NO-FINAL',
5858
'COMP-GET-WITH-CL-BODY','COMP-CHUNKED-EXTENSION',
59-
'COMP-CHUNKED-TRAILER-VALID','COMP-CHUNKED-HEX-UPPERCASE'
59+
'COMP-CHUNKED-TRAILER-VALID','COMP-CHUNKED-HEX-UPPERCASE',
60+
'COMP-RANGE-POST'
6061
]},
6162
{ key: 'methods-upgrade', label: 'Methods & Upgrade', testIds: [
6263
'COMP-METHOD-CONNECT',
6364
'COMP-UNKNOWN-TE-501','COMP-EXPECT-UNKNOWN','COMP-METHOD-TRACE',
6465
'COMP-TRACE-WITH-BODY',
6566
'COMP-UPGRADE-POST','COMP-UPGRADE-MISSING-CONN',
66-
'COMP-UPGRADE-UNKNOWN','COMP-UPGRADE-INVALID-VER',
67+
'COMP-UPGRADE-UNKNOWN','COMP-UPGRADE-INVALID-VER','COMP-UPGRADE-HTTP10',
6768
'COMP-CONNECTION-CLOSE','COMP-HTTP10-DEFAULT-CLOSE','COMP-HTTP10-NO-HOST'
6869
]}
6970
];

‎docs/content/docs/body/range-post.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
title: "RANGE-POST"
3+
description: "RANGE-POST test documentation"
4+
weight: 13
5+
---
6+
7+
| | |
8+
|---|---|
9+
| **Test ID** | `COMP-RANGE-POST` |
10+
| **Category** | Compliance |
11+
| **Scored** | Yes |
12+
| **RFC** | [RFC 9110 §14.2](https://www.rfc-editor.org/rfc/rfc9110#section-14.2) |
13+
| **RFC Level** | MUST |
14+
| **Expected** | `2xx` (Range ignored) |
15+
16+
## What it sends
17+
18+
A POST request with a `Range` header. The Range mechanism only applies to GET requests.
19+
20+
```http
21+
POST / HTTP/1.1\r\n
22+
Host: localhost:8080\r\n
23+
Content-Length: 5\r\n
24+
Range: bytes=0-10\r\n
25+
\r\n
26+
hello
27+
```
28+
29+
## What the RFC says
30+
31+
> "A server MUST ignore a Range header field received with a request method that is unrecognized or for which range handling is not defined." — RFC 9110 §14.2
32+
33+
Range handling is only defined for GET (RFC 9110 §14.2). For all other methods, the server must ignore the Range header and process the request normally.
34+
35+
## Why it matters
36+
37+
If a server incorrectly applies Range semantics to a POST request (returning `206 Partial Content`), it could truncate the request body or cause unexpected behavior. The server should process the full POST body and return a normal `2xx` response.
38+
39+
## Verdicts
40+
41+
- **Pass** — Server returns `2xx` (correctly ignored Range for POST)
42+
- **Fail** — Server returns `206` (incorrectly applied Range to POST) or any non-2xx response
43+
44+
## Sources
45+
46+
- [RFC 9110 §14.2](https://www.rfc-editor.org/rfc/rfc9110#section-14.2)

‎docs/content/docs/upgrade/upgrade-http10.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
title: "UPGRADE-HTTP10"
3+
description: "UPGRADE-HTTP10 test documentation"
4+
weight: 5
5+
---
6+
7+
| | |
8+
|---|---|
9+
| **Test ID** | `COMP-UPGRADE-HTTP10` |
10+
| **Category** | Compliance |
11+
| **Scored** | Yes |
12+
| **RFC** | [RFC 9110 §7.8](https://www.rfc-editor.org/rfc/rfc9110#section-7.8) |
13+
| **RFC Level** | MUST |
14+
| **Expected** | Not `101` |
15+
16+
## What it sends
17+
18+
An HTTP/1.0 request with WebSocket upgrade headers. The server must ignore the Upgrade field because it was received in an HTTP/1.0 request.
19+
20+
```http
21+
GET / HTTP/1.0\r\n
22+
Host: localhost:8080\r\n
23+
Connection: Upgrade\r\n
24+
Upgrade: websocket\r\n
25+
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n
26+
Sec-WebSocket-Version: 13\r\n
27+
\r\n
28+
```
29+
30+
## What the RFC says
31+
32+
> "A server that receives an Upgrade header field in an HTTP/1.0 request MUST ignore that Upgrade field." — RFC 9110 §7.8
33+
34+
The Upgrade mechanism is an HTTP/1.1 feature. An HTTP/1.0 client cannot participate in protocol switching, so the server must not attempt it.
35+
36+
## Why it matters
37+
38+
If a server processes an Upgrade from an HTTP/1.0 client and returns `101 Switching Protocols`, the client likely cannot handle the protocol switch. This could lead to connection corruption or security issues, especially if a proxy is involved that speaks HTTP/1.0 to the backend.
39+
40+
## Verdicts
41+
42+
- **Pass** — Server returns any status other than `101` (correctly ignored Upgrade)
43+
- **Fail** — Server returns `101 Switching Protocols` (incorrectly upgraded an HTTP/1.0 request)
44+
45+
## Sources
46+
47+
- [RFC 9110 §7.8](https://www.rfc-editor.org/rfc/rfc9110#section-7.8)

‎docs/static/probe/render.js‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,8 @@ window.ProbeRender = (function () {
279279
'COMP-POST-NO-CL-NO-TE': '/Http11Probe/docs/body/post-no-cl-no-te/',
280280
'COMP-UNKNOWN-METHOD': '/Http11Probe/docs/request-line/unknown-method/',
281281
'COMP-UNKNOWN-TE-501': '/Http11Probe/docs/request-line/unknown-te-501/',
282+
'COMP-RANGE-POST': '/Http11Probe/docs/body/range-post/',
283+
'COMP-UPGRADE-HTTP10': '/Http11Probe/docs/upgrade/upgrade-http10/',
282284
'COMP-UPGRADE-INVALID-VER': '/Http11Probe/docs/upgrade/upgrade-invalid-ver/',
283285
'COMP-UPGRADE-MISSING-CONN': '/Http11Probe/docs/upgrade/upgrade-missing-conn/',
284286
'COMP-UPGRADE-POST': '/Http11Probe/docs/upgrade/upgrade-post/',

‎src/Http11Probe/TestCases/Suites/ComplianceSuite.cs‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1090,6 +1090,54 @@ public static IEnumerable<TestCase> GetTestCases()
10901090
}
10911091
};
10921092

1093+
// ── Range / Conditional ─────────────────────────────────────
1094+
1095+
yield return new TestCase
1096+
{
1097+
Id = "COMP-RANGE-POST",
1098+
Description = "Range header on POST must be ignored — Range only applies to GET",
1099+
Category = TestCategory.Compliance,
1100+
RfcReference = "RFC 9110 §14.2",
1101+
PayloadFactory = ctx => MakeRequest(
1102+
$"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nContent-Length: 5\r\nRange: bytes=0-10\r\n\r\nhello"),
1103+
Expected = new ExpectedBehavior
1104+
{
1105+
Description = "2xx (Range ignored)",
1106+
CustomValidator = (response, state) =>
1107+
{
1108+
if (response is null)
1109+
return state == ConnectionState.ClosedByServer ? TestVerdict.Fail : TestVerdict.Fail;
1110+
if (response.StatusCode == 206)
1111+
return TestVerdict.Fail;
1112+
if (response.StatusCode is >= 200 and < 300)
1113+
return TestVerdict.Pass;
1114+
return TestVerdict.Fail;
1115+
}
1116+
}
1117+
};
1118+
1119+
yield return new TestCase
1120+
{
1121+
Id = "COMP-UPGRADE-HTTP10",
1122+
Description = "Upgrade header in HTTP/1.0 request must be ignored",
1123+
Category = TestCategory.Compliance,
1124+
RfcReference = "RFC 9110 §7.8",
1125+
PayloadFactory = ctx => MakeRequest(
1126+
$"GET / HTTP/1.0\r\nHost: {ctx.HostHeader}\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n"),
1127+
Expected = new ExpectedBehavior
1128+
{
1129+
Description = "!101",
1130+
CustomValidator = (response, state) =>
1131+
{
1132+
if (response is null)
1133+
return state == ConnectionState.ClosedByServer ? TestVerdict.Pass : TestVerdict.Fail;
1134+
if (response.StatusCode == 101)
1135+
return TestVerdict.Fail;
1136+
return TestVerdict.Pass;
1137+
}
1138+
}
1139+
};
1140+
10931141
// ── RFC 9110 response semantics ──────────────────────────────
10941142

10951143
yield return new TestCase

0 commit comments

Comments
 (0)