Tests for HTTP/1.1 Parsing (NUL, CR, LF, Colon and more)

[JannisBush]

Parsing (invalid) HTTP/1.1 responses is not fully defined in HTTP and Fetch and browser behavior diverges from the specs and between different browsers and there are not many tests in WPT yet. The aim of this pull request is to document the current browser behavior for various edge cases and start standardizing edge case behavior.

This pull requests adds a bunch of tests for (invalid) HTTP/1.1 responses for various edge cases. The tests are marked as tentative.
The tests are about the general parsing of (invalid) HTTP/1.1 messages and are not about the parsing of individual (invalid) headers such as how browsers should handle invalid bytes in CSP headers (Pull Request for that here).

All tests use the following base response and inject various bytes in different places to test both status-line and header-line parsing.
There are two types of tests:

• fetch tests: they fetch the resource and either fail (Network Error) or fetch the resource (Valid)
• framing tests: they frame the resource in an IFrame. They can result in Network Error (browser renders an error frame), active-XFO (browser renders an error frame due to XFO), or render the iframe (no-XFO, either the value is invalid or the full header line containing XFO is ignored). Note that the tests currently do not distinguish between Network Error and active-XFO.

HTTP/1.1 200 OK
X-Frame-Options: DENY
Content-Length: 5

Test.

The following shows all the injection points and their names:

<first>HT<in-http>TP<before-slash>/<after-slash>1<before-dot>.<after-dot>1<after-ver> <before-num>200<after-num> <before-reason>OK<after-reason>
<leading>X-Frame<in-name>-Options<before-colon>:<after-colon>DE<in-value>NY<after-value>
Content-Length: 5

Test.

The following bytes are injected: LF, CR, HTAB, SP, NUL, COLON.

The expected behavior is described in a mapping:

let expected = {
    "SP": {
        "first": ["Network Error", "Network Error"],
        ...
        "in-value": ["Valid", "no-XFO"],
        "after-value": ["Valid", "active-XFO"]
    },
    ...
}

Currently, there are 102*2=204 tests. In the future, other characters could be injected or other tests can be added.
The initial expected mapping is strict and expects "Network Error" for almost everything that is not explicitly allowed.
The current results are (both on HTTP and HTTPS):

• Chrome: 114 Pass, 90 Fail
• Firefox: 61 Pass, 143 Fail
• Safari: 92 Pass, 112 Fail

---

See also:

• Fetch overview issue of HTTP/1.1 parsing
• Define behavior for invalid header names
• Related bug reports in Safari: https://bugs.webkit.org/show_bug.cgi?id=285661, https://bugs.webkit.org/show_bug.cgi?id=285606, https://bugs.webkit.org/show_bug.cgi?id=272749, https://bugs.webkit.org/show_bug.cgi?id=272748, https://bugs.webkit.org/show_bug.cgi?id=272740
• Related bug reports in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1891719

[jdm]

This is very thorough! I appreciate all of the clear explanations for the expected results.