From fa7d5392b15f1b25a3a6cb8845753f27d8d32072 Mon Sep 17 00:00:00 2001 From: Diogo Martins Date: Thu, 12 Feb 2026 21:53:31 +0000 Subject: [PATCH 1/2] Add feature - ON mouse hover or click show a detailed info on request and response --- .github/workflows/probe.yml | 3 + docs/hugo.yaml | 7 +- docs/static/probe/data.js | 1 + docs/static/probe/render.js | 111 +- src/Http11Probe.Cli/Reporting/JsonReporter.cs | 5 +- src/Http11Probe/Response/HttpResponse.cs | 2 + src/Http11Probe/Response/ResponseParser.cs | 19 +- src/Http11Probe/Runner/TestRunner.cs | 5 + .../TestCases/Suites/SmugglingSuite.cs | 68 +- src/Http11Probe/TestCases/TestCase.cs | 3 + src/Http11Probe/TestCases/TestResult.cs | 2 + src/Servers/ActixServer/src/main.rs | 18 +- src/Servers/AspNetMinimal/Program.cs | 7 +- src/Servers/BunServer/server.ts | 6 +- src/Servers/DenoServer/server.ts | 6 +- src/Servers/EmbedIOServer/Program.cs | 13 +- .../ExpressServer/node_modules/.bin/mime | 1 + .../node_modules/.package-lock.json | 751 ++ .../node_modules/accepts/HISTORY.md | 243 + .../node_modules/accepts/LICENSE | 23 + .../node_modules/accepts/README.md | 140 + .../node_modules/accepts/index.js | 238 + .../node_modules/accepts/package.json | 47 + .../node_modules/array-flatten/LICENSE | 21 + .../node_modules/array-flatten/README.md | 43 + .../array-flatten/array-flatten.js | 64 + .../node_modules/array-flatten/package.json | 39 + .../node_modules/body-parser/HISTORY.md | 680 ++ .../node_modules/body-parser/LICENSE | 23 + .../node_modules/body-parser/README.md | 476 + .../node_modules/body-parser/index.js | 156 + .../node_modules/body-parser/lib/read.js | 205 + .../body-parser/lib/types/json.js | 247 + .../node_modules/body-parser/lib/types/raw.js | 101 + .../body-parser/lib/types/text.js | 121 + .../body-parser/lib/types/urlencoded.js | 300 + .../node_modules/body-parser/package.json | 55 + .../node_modules/bytes/History.md | 97 + .../ExpressServer/node_modules/bytes/LICENSE | 23 + .../node_modules/bytes/Readme.md | 152 + .../ExpressServer/node_modules/bytes/index.js | 170 + .../node_modules/bytes/package.json | 42 + .../call-bind-apply-helpers/.eslintrc | 17 + .../.github/FUNDING.yml | 12 + .../call-bind-apply-helpers/.nycrc | 9 + .../call-bind-apply-helpers/CHANGELOG.md | 30 + .../call-bind-apply-helpers/LICENSE | 21 + .../call-bind-apply-helpers/README.md | 62 + .../call-bind-apply-helpers/actualApply.d.ts | 1 + .../call-bind-apply-helpers/actualApply.js | 10 + .../call-bind-apply-helpers/applyBind.d.ts | 19 + .../call-bind-apply-helpers/applyBind.js | 10 + .../functionApply.d.ts | 1 + .../call-bind-apply-helpers/functionApply.js | 4 + .../call-bind-apply-helpers/functionCall.d.ts | 1 + .../call-bind-apply-helpers/functionCall.js | 4 + .../call-bind-apply-helpers/index.d.ts | 64 + .../call-bind-apply-helpers/index.js | 15 + .../call-bind-apply-helpers/package.json | 85 + .../call-bind-apply-helpers/reflectApply.d.ts | 3 + .../call-bind-apply-helpers/reflectApply.js | 4 + .../call-bind-apply-helpers/test/index.js | 63 + .../call-bind-apply-helpers/tsconfig.json | 9 + .../node_modules/call-bound/.eslintrc | 13 + .../call-bound/.github/FUNDING.yml | 12 + .../node_modules/call-bound/.nycrc | 9 + .../node_modules/call-bound/CHANGELOG.md | 42 + .../node_modules/call-bound/LICENSE | 21 + .../node_modules/call-bound/README.md | 53 + .../node_modules/call-bound/index.d.ts | 94 + .../node_modules/call-bound/index.js | 19 + .../node_modules/call-bound/package.json | 99 + .../node_modules/call-bound/test/index.js | 61 + .../node_modules/call-bound/tsconfig.json | 10 + .../content-disposition/HISTORY.md | 60 + .../node_modules/content-disposition/LICENSE | 22 + .../content-disposition/README.md | 142 + .../node_modules/content-disposition/index.js | 458 + .../content-disposition/package.json | 44 + .../node_modules/content-type/HISTORY.md | 29 + .../node_modules/content-type/LICENSE | 22 + .../node_modules/content-type/README.md | 94 + .../node_modules/content-type/index.js | 225 + .../node_modules/content-type/package.json | 42 + .../node_modules/cookie-signature/History.md | 42 + .../node_modules/cookie-signature/Readme.md | 42 + .../node_modules/cookie-signature/index.js | 51 + .../cookie-signature/package.json | 18 + .../ExpressServer/node_modules/cookie/LICENSE | 24 + .../node_modules/cookie/README.md | 317 + .../node_modules/cookie/SECURITY.md | 25 + .../node_modules/cookie/index.js | 335 + .../node_modules/cookie/package.json | 44 + .../node_modules/depd/History.md | 103 + .../ExpressServer/node_modules/depd/LICENSE | 22 + .../ExpressServer/node_modules/depd/Readme.md | 280 + .../ExpressServer/node_modules/depd/index.js | 538 ++ .../node_modules/depd/lib/browser/index.js | 77 + .../node_modules/depd/package.json | 45 + .../node_modules/destroy/LICENSE | 23 + .../node_modules/destroy/README.md | 63 + .../node_modules/destroy/index.js | 209 + .../node_modules/destroy/package.json | 48 + .../node_modules/dunder-proto/.eslintrc | 5 + .../dunder-proto/.github/FUNDING.yml | 12 + .../node_modules/dunder-proto/.nycrc | 13 + .../node_modules/dunder-proto/CHANGELOG.md | 24 + .../node_modules/dunder-proto/LICENSE | 21 + .../node_modules/dunder-proto/README.md | 54 + .../node_modules/dunder-proto/get.d.ts | 5 + .../node_modules/dunder-proto/get.js | 30 + .../node_modules/dunder-proto/package.json | 76 + .../node_modules/dunder-proto/set.d.ts | 5 + .../node_modules/dunder-proto/set.js | 35 + .../node_modules/dunder-proto/test/get.js | 34 + .../node_modules/dunder-proto/test/index.js | 4 + .../node_modules/dunder-proto/test/set.js | 50 + .../node_modules/dunder-proto/tsconfig.json | 9 + .../node_modules/ee-first/LICENSE | 22 + .../node_modules/ee-first/README.md | 80 + .../node_modules/ee-first/index.js | 95 + .../node_modules/ee-first/package.json | 29 + .../node_modules/encodeurl/LICENSE | 22 + .../node_modules/encodeurl/README.md | 109 + .../node_modules/encodeurl/index.js | 60 + .../node_modules/encodeurl/package.json | 40 + .../node_modules/es-define-property/.eslintrc | 13 + .../es-define-property/.github/FUNDING.yml | 12 + .../node_modules/es-define-property/.nycrc | 9 + .../es-define-property/CHANGELOG.md | 29 + .../node_modules/es-define-property/LICENSE | 21 + .../node_modules/es-define-property/README.md | 49 + .../es-define-property/index.d.ts | 3 + .../node_modules/es-define-property/index.js | 14 + .../es-define-property/package.json | 81 + .../es-define-property/test/index.js | 56 + .../es-define-property/tsconfig.json | 10 + .../node_modules/es-errors/.eslintrc | 5 + .../es-errors/.github/FUNDING.yml | 12 + .../node_modules/es-errors/CHANGELOG.md | 40 + .../node_modules/es-errors/LICENSE | 21 + .../node_modules/es-errors/README.md | 55 + .../node_modules/es-errors/eval.d.ts | 3 + .../node_modules/es-errors/eval.js | 4 + .../node_modules/es-errors/index.d.ts | 3 + .../node_modules/es-errors/index.js | 4 + .../node_modules/es-errors/package.json | 80 + .../node_modules/es-errors/range.d.ts | 3 + .../node_modules/es-errors/range.js | 4 + .../node_modules/es-errors/ref.d.ts | 3 + .../node_modules/es-errors/ref.js | 4 + .../node_modules/es-errors/syntax.d.ts | 3 + .../node_modules/es-errors/syntax.js | 4 + .../node_modules/es-errors/test/index.js | 19 + .../node_modules/es-errors/tsconfig.json | 49 + .../node_modules/es-errors/type.d.ts | 3 + .../node_modules/es-errors/type.js | 4 + .../node_modules/es-errors/uri.d.ts | 3 + .../node_modules/es-errors/uri.js | 4 + .../node_modules/es-object-atoms/.eslintrc | 16 + .../es-object-atoms/.github/FUNDING.yml | 12 + .../node_modules/es-object-atoms/CHANGELOG.md | 37 + .../node_modules/es-object-atoms/LICENSE | 21 + .../node_modules/es-object-atoms/README.md | 63 + .../RequireObjectCoercible.d.ts | 3 + .../es-object-atoms/RequireObjectCoercible.js | 11 + .../es-object-atoms/ToObject.d.ts | 7 + .../node_modules/es-object-atoms/ToObject.js | 10 + .../node_modules/es-object-atoms/index.d.ts | 3 + .../node_modules/es-object-atoms/index.js | 4 + .../es-object-atoms/isObject.d.ts | 3 + .../node_modules/es-object-atoms/isObject.js | 6 + .../node_modules/es-object-atoms/package.json | 80 + .../es-object-atoms/test/index.js | 38 + .../es-object-atoms/tsconfig.json | 6 + .../node_modules/escape-html/LICENSE | 24 + .../node_modules/escape-html/Readme.md | 43 + .../node_modules/escape-html/index.js | 78 + .../node_modules/escape-html/package.json | 24 + .../node_modules/etag/HISTORY.md | 83 + .../ExpressServer/node_modules/etag/LICENSE | 22 + .../ExpressServer/node_modules/etag/README.md | 159 + .../ExpressServer/node_modules/etag/index.js | 131 + .../node_modules/etag/package.json | 47 + .../node_modules/express/History.md | 3667 +++++++ .../node_modules/express/LICENSE | 24 + .../node_modules/express/Readme.md | 260 + .../node_modules/express/index.js | 11 + .../node_modules/express/lib/application.js | 661 ++ .../node_modules/express/lib/express.js | 116 + .../express/lib/middleware/init.js | 43 + .../express/lib/middleware/query.js | 47 + .../node_modules/express/lib/request.js | 525 + .../node_modules/express/lib/response.js | 1179 +++ .../node_modules/express/lib/router/index.js | 673 ++ .../node_modules/express/lib/router/layer.js | 181 + .../node_modules/express/lib/router/route.js | 230 + .../node_modules/express/lib/utils.js | 303 + .../node_modules/express/lib/view.js | 182 + .../node_modules/express/package.json | 102 + .../node_modules/finalhandler/HISTORY.md | 216 + .../node_modules/finalhandler/LICENSE | 22 + .../node_modules/finalhandler/README.md | 147 + .../node_modules/finalhandler/SECURITY.md | 25 + .../node_modules/finalhandler/index.js | 341 + .../node_modules/finalhandler/package.json | 47 + .../node_modules/forwarded/HISTORY.md | 21 + .../node_modules/forwarded/LICENSE | 22 + .../node_modules/forwarded/README.md | 57 + .../node_modules/forwarded/index.js | 90 + .../node_modules/forwarded/package.json | 45 + .../node_modules/fresh/HISTORY.md | 70 + .../ExpressServer/node_modules/fresh/LICENSE | 23 + .../node_modules/fresh/README.md | 119 + .../ExpressServer/node_modules/fresh/index.js | 137 + .../node_modules/fresh/package.json | 46 + .../node_modules/function-bind/.eslintrc | 21 + .../function-bind/.github/FUNDING.yml | 12 + .../function-bind/.github/SECURITY.md | 3 + .../node_modules/function-bind/.nycrc | 13 + .../node_modules/function-bind/CHANGELOG.md | 136 + .../node_modules/function-bind/LICENSE | 20 + .../node_modules/function-bind/README.md | 46 + .../function-bind/implementation.js | 84 + .../node_modules/function-bind/index.js | 5 + .../node_modules/function-bind/package.json | 87 + .../node_modules/function-bind/test/.eslintrc | 9 + .../node_modules/function-bind/test/index.js | 252 + .../node_modules/get-intrinsic/.eslintrc | 42 + .../get-intrinsic/.github/FUNDING.yml | 12 + .../node_modules/get-intrinsic/.nycrc | 9 + .../node_modules/get-intrinsic/CHANGELOG.md | 186 + .../node_modules/get-intrinsic/LICENSE | 21 + .../node_modules/get-intrinsic/README.md | 71 + .../node_modules/get-intrinsic/index.js | 378 + .../node_modules/get-intrinsic/package.json | 97 + .../get-intrinsic/test/GetIntrinsic.js | 274 + .../node_modules/get-proto/.eslintrc | 10 + .../get-proto/.github/FUNDING.yml | 12 + .../node_modules/get-proto/.nycrc | 9 + .../node_modules/get-proto/CHANGELOG.md | 21 + .../node_modules/get-proto/LICENSE | 21 + .../get-proto/Object.getPrototypeOf.d.ts | 5 + .../get-proto/Object.getPrototypeOf.js | 6 + .../node_modules/get-proto/README.md | 50 + .../get-proto/Reflect.getPrototypeOf.d.ts | 3 + .../get-proto/Reflect.getPrototypeOf.js | 4 + .../node_modules/get-proto/index.d.ts | 5 + .../node_modules/get-proto/index.js | 27 + .../node_modules/get-proto/package.json | 81 + .../node_modules/get-proto/test/index.js | 68 + .../node_modules/get-proto/tsconfig.json | 9 + .../ExpressServer/node_modules/gopd/.eslintrc | 16 + .../node_modules/gopd/.github/FUNDING.yml | 12 + .../node_modules/gopd/CHANGELOG.md | 45 + .../ExpressServer/node_modules/gopd/LICENSE | 21 + .../ExpressServer/node_modules/gopd/README.md | 40 + .../ExpressServer/node_modules/gopd/gOPD.d.ts | 1 + .../ExpressServer/node_modules/gopd/gOPD.js | 4 + .../node_modules/gopd/index.d.ts | 5 + .../ExpressServer/node_modules/gopd/index.js | 15 + .../node_modules/gopd/package.json | 77 + .../node_modules/gopd/test/index.js | 36 + .../node_modules/gopd/tsconfig.json | 9 + .../node_modules/has-symbols/.eslintrc | 11 + .../has-symbols/.github/FUNDING.yml | 12 + .../node_modules/has-symbols/.nycrc | 9 + .../node_modules/has-symbols/CHANGELOG.md | 91 + .../node_modules/has-symbols/LICENSE | 21 + .../node_modules/has-symbols/README.md | 46 + .../node_modules/has-symbols/index.d.ts | 3 + .../node_modules/has-symbols/index.js | 14 + .../node_modules/has-symbols/package.json | 111 + .../node_modules/has-symbols/shams.d.ts | 3 + .../node_modules/has-symbols/shams.js | 45 + .../node_modules/has-symbols/test/index.js | 22 + .../has-symbols/test/shams/core-js.js | 29 + .../test/shams/get-own-property-symbols.js | 29 + .../node_modules/has-symbols/test/tests.js | 58 + .../node_modules/has-symbols/tsconfig.json | 10 + .../node_modules/hasown/.eslintrc | 5 + .../node_modules/hasown/.github/FUNDING.yml | 12 + .../ExpressServer/node_modules/hasown/.nycrc | 13 + .../node_modules/hasown/CHANGELOG.md | 40 + .../ExpressServer/node_modules/hasown/LICENSE | 21 + .../node_modules/hasown/README.md | 40 + .../node_modules/hasown/index.d.ts | 3 + .../node_modules/hasown/index.js | 8 + .../node_modules/hasown/package.json | 92 + .../node_modules/hasown/tsconfig.json | 6 + .../node_modules/http-errors/HISTORY.md | 186 + .../node_modules/http-errors/LICENSE | 23 + .../node_modules/http-errors/README.md | 169 + .../node_modules/http-errors/index.js | 290 + .../node_modules/http-errors/package.json | 54 + .../node_modules/iconv-lite/Changelog.md | 162 + .../node_modules/iconv-lite/LICENSE | 21 + .../node_modules/iconv-lite/README.md | 156 + .../iconv-lite/encodings/dbcs-codec.js | 555 ++ .../iconv-lite/encodings/dbcs-data.js | 176 + .../iconv-lite/encodings/index.js | 22 + .../iconv-lite/encodings/internal.js | 188 + .../iconv-lite/encodings/sbcs-codec.js | 72 + .../encodings/sbcs-data-generated.js | 451 + .../iconv-lite/encodings/sbcs-data.js | 174 + .../encodings/tables/big5-added.json | 122 + .../iconv-lite/encodings/tables/cp936.json | 264 + .../iconv-lite/encodings/tables/cp949.json | 273 + .../iconv-lite/encodings/tables/cp950.json | 177 + .../iconv-lite/encodings/tables/eucjp.json | 182 + .../encodings/tables/gb18030-ranges.json | 1 + .../encodings/tables/gbk-added.json | 55 + .../iconv-lite/encodings/tables/shiftjis.json | 125 + .../iconv-lite/encodings/utf16.js | 177 + .../node_modules/iconv-lite/encodings/utf7.js | 290 + .../iconv-lite/lib/bom-handling.js | 52 + .../iconv-lite/lib/extend-node.js | 217 + .../node_modules/iconv-lite/lib/index.d.ts | 24 + .../node_modules/iconv-lite/lib/index.js | 153 + .../node_modules/iconv-lite/lib/streams.js | 121 + .../node_modules/iconv-lite/package.json | 46 + .../node_modules/inherits/LICENSE | 16 + .../node_modules/inherits/README.md | 42 + .../node_modules/inherits/inherits.js | 9 + .../node_modules/inherits/inherits_browser.js | 27 + .../node_modules/inherits/package.json | 29 + .../node_modules/ipaddr.js/LICENSE | 19 + .../node_modules/ipaddr.js/README.md | 233 + .../node_modules/ipaddr.js/ipaddr.min.js | 1 + .../node_modules/ipaddr.js/lib/ipaddr.js | 673 ++ .../node_modules/ipaddr.js/lib/ipaddr.js.d.ts | 68 + .../node_modules/ipaddr.js/package.json | 35 + .../node_modules/math-intrinsics/.eslintrc | 16 + .../math-intrinsics/.github/FUNDING.yml | 12 + .../node_modules/math-intrinsics/CHANGELOG.md | 24 + .../node_modules/math-intrinsics/LICENSE | 21 + .../node_modules/math-intrinsics/README.md | 50 + .../node_modules/math-intrinsics/abs.d.ts | 1 + .../node_modules/math-intrinsics/abs.js | 4 + .../constants/maxArrayLength.d.ts | 3 + .../constants/maxArrayLength.js | 4 + .../constants/maxSafeInteger.d.ts | 3 + .../constants/maxSafeInteger.js | 5 + .../math-intrinsics/constants/maxValue.d.ts | 3 + .../math-intrinsics/constants/maxValue.js | 5 + .../node_modules/math-intrinsics/floor.d.ts | 1 + .../node_modules/math-intrinsics/floor.js | 4 + .../math-intrinsics/isFinite.d.ts | 3 + .../node_modules/math-intrinsics/isFinite.js | 12 + .../math-intrinsics/isInteger.d.ts | 3 + .../node_modules/math-intrinsics/isInteger.js | 16 + .../node_modules/math-intrinsics/isNaN.d.ts | 1 + .../node_modules/math-intrinsics/isNaN.js | 6 + .../math-intrinsics/isNegativeZero.d.ts | 3 + .../math-intrinsics/isNegativeZero.js | 6 + .../node_modules/math-intrinsics/max.d.ts | 1 + .../node_modules/math-intrinsics/max.js | 4 + .../node_modules/math-intrinsics/min.d.ts | 1 + .../node_modules/math-intrinsics/min.js | 4 + .../node_modules/math-intrinsics/mod.d.ts | 3 + .../node_modules/math-intrinsics/mod.js | 9 + .../node_modules/math-intrinsics/package.json | 86 + .../node_modules/math-intrinsics/pow.d.ts | 1 + .../node_modules/math-intrinsics/pow.js | 4 + .../node_modules/math-intrinsics/round.d.ts | 1 + .../node_modules/math-intrinsics/round.js | 4 + .../node_modules/math-intrinsics/sign.d.ts | 3 + .../node_modules/math-intrinsics/sign.js | 11 + .../math-intrinsics/test/index.js | 192 + .../math-intrinsics/tsconfig.json | 3 + .../node_modules/media-typer/HISTORY.md | 22 + .../node_modules/media-typer/LICENSE | 22 + .../node_modules/media-typer/README.md | 81 + .../node_modules/media-typer/index.js | 270 + .../node_modules/media-typer/package.json | 26 + .../node_modules/merge-descriptors/HISTORY.md | 21 + .../node_modules/merge-descriptors/LICENSE | 23 + .../node_modules/merge-descriptors/README.md | 49 + .../node_modules/merge-descriptors/index.js | 60 + .../merge-descriptors/package.json | 39 + .../node_modules/methods/HISTORY.md | 29 + .../node_modules/methods/LICENSE | 24 + .../node_modules/methods/README.md | 51 + .../node_modules/methods/index.js | 69 + .../node_modules/methods/package.json | 36 + .../node_modules/mime-db/HISTORY.md | 507 + .../node_modules/mime-db/LICENSE | 23 + .../node_modules/mime-db/README.md | 100 + .../node_modules/mime-db/db.json | 8519 +++++++++++++++++ .../node_modules/mime-db/index.js | 12 + .../node_modules/mime-db/package.json | 60 + .../node_modules/mime-types/HISTORY.md | 397 + .../node_modules/mime-types/LICENSE | 23 + .../node_modules/mime-types/README.md | 113 + .../node_modules/mime-types/index.js | 188 + .../node_modules/mime-types/package.json | 44 + .../node_modules/mime/.npmignore | 0 .../node_modules/mime/CHANGELOG.md | 164 + .../ExpressServer/node_modules/mime/LICENSE | 21 + .../ExpressServer/node_modules/mime/README.md | 90 + .../ExpressServer/node_modules/mime/cli.js | 8 + .../ExpressServer/node_modules/mime/mime.js | 108 + .../node_modules/mime/package.json | 44 + .../node_modules/mime/src/build.js | 53 + .../node_modules/mime/src/test.js | 60 + .../node_modules/mime/types.json | 1 + .../ExpressServer/node_modules/ms/index.js | 152 + .../ExpressServer/node_modules/ms/license.md | 21 + .../node_modules/ms/package.json | 37 + .../ExpressServer/node_modules/ms/readme.md | 51 + .../node_modules/negotiator/HISTORY.md | 108 + .../node_modules/negotiator/LICENSE | 24 + .../node_modules/negotiator/README.md | 203 + .../node_modules/negotiator/index.js | 82 + .../node_modules/negotiator/lib/charset.js | 169 + .../node_modules/negotiator/lib/encoding.js | 184 + .../node_modules/negotiator/lib/language.js | 179 + .../node_modules/negotiator/lib/mediaType.js | 294 + .../node_modules/negotiator/package.json | 42 + .../node_modules/object-inspect/.eslintrc | 53 + .../object-inspect/.github/FUNDING.yml | 12 + .../node_modules/object-inspect/.nycrc | 13 + .../node_modules/object-inspect/CHANGELOG.md | 424 + .../node_modules/object-inspect/LICENSE | 21 + .../object-inspect/example/all.js | 23 + .../object-inspect/example/circular.js | 6 + .../node_modules/object-inspect/example/fn.js | 5 + .../object-inspect/example/inspect.js | 10 + .../node_modules/object-inspect/index.js | 544 ++ .../object-inspect/package-support.json | 20 + .../node_modules/object-inspect/package.json | 105 + .../object-inspect/readme.markdown | 84 + .../object-inspect/test-core-js.js | 26 + .../object-inspect/test/bigint.js | 58 + .../object-inspect/test/browser/dom.js | 15 + .../object-inspect/test/circular.js | 16 + .../node_modules/object-inspect/test/deep.js | 12 + .../object-inspect/test/element.js | 53 + .../node_modules/object-inspect/test/err.js | 48 + .../node_modules/object-inspect/test/fakes.js | 29 + .../node_modules/object-inspect/test/fn.js | 76 + .../object-inspect/test/global.js | 17 + .../node_modules/object-inspect/test/has.js | 15 + .../node_modules/object-inspect/test/holes.js | 15 + .../object-inspect/test/indent-option.js | 271 + .../object-inspect/test/inspect.js | 139 + .../object-inspect/test/lowbyte.js | 12 + .../object-inspect/test/number.js | 58 + .../object-inspect/test/quoteStyle.js | 26 + .../object-inspect/test/toStringTag.js | 40 + .../node_modules/object-inspect/test/undef.js | 12 + .../object-inspect/test/values.js | 261 + .../object-inspect/util.inspect.js | 1 + .../node_modules/on-finished/HISTORY.md | 98 + .../node_modules/on-finished/LICENSE | 23 + .../node_modules/on-finished/README.md | 162 + .../node_modules/on-finished/index.js | 234 + .../node_modules/on-finished/package.json | 39 + .../node_modules/parseurl/HISTORY.md | 58 + .../node_modules/parseurl/LICENSE | 24 + .../node_modules/parseurl/README.md | 133 + .../node_modules/parseurl/index.js | 158 + .../node_modules/parseurl/package.json | 40 + .../node_modules/path-to-regexp/LICENSE | 21 + .../node_modules/path-to-regexp/Readme.md | 35 + .../node_modules/path-to-regexp/index.js | 156 + .../node_modules/path-to-regexp/package.json | 30 + .../node_modules/proxy-addr/HISTORY.md | 161 + .../node_modules/proxy-addr/LICENSE | 22 + .../node_modules/proxy-addr/README.md | 139 + .../node_modules/proxy-addr/index.js | 327 + .../node_modules/proxy-addr/package.json | 47 + .../node_modules/qs/.editorconfig | 46 + .../node_modules/qs/.github/FUNDING.yml | 12 + .../node_modules/qs/.github/SECURITY.md | 11 + .../node_modules/qs/.github/THREAT_MODEL.md | 78 + .../ExpressServer/node_modules/qs/.nycrc | 13 + .../node_modules/qs/CHANGELOG.md | 644 ++ .../ExpressServer/node_modules/qs/LICENSE.md | 29 + .../ExpressServer/node_modules/qs/README.md | 740 ++ .../ExpressServer/node_modules/qs/dist/qs.js | 141 + .../node_modules/qs/eslint.config.mjs | 56 + .../node_modules/qs/lib/formats.js | 23 + .../node_modules/qs/lib/index.js | 11 + .../node_modules/qs/lib/parse.js | 371 + .../node_modules/qs/lib/stringify.js | 356 + .../node_modules/qs/lib/utils.js | 340 + .../node_modules/qs/package.json | 94 + .../node_modules/qs/test/empty-keys-cases.js | 267 + .../node_modules/qs/test/parse.js | 1512 +++ .../node_modules/qs/test/stringify.js | 1310 +++ .../node_modules/qs/test/utils.js | 397 + .../node_modules/range-parser/HISTORY.md | 56 + .../node_modules/range-parser/LICENSE | 23 + .../node_modules/range-parser/README.md | 84 + .../node_modules/range-parser/index.js | 162 + .../node_modules/range-parser/package.json | 44 + .../node_modules/raw-body/LICENSE | 22 + .../node_modules/raw-body/README.md | 223 + .../node_modules/raw-body/index.d.ts | 87 + .../node_modules/raw-body/index.js | 336 + .../node_modules/raw-body/package.json | 47 + .../node_modules/safe-buffer/LICENSE | 21 + .../node_modules/safe-buffer/README.md | 584 ++ .../node_modules/safe-buffer/index.d.ts | 187 + .../node_modules/safe-buffer/index.js | 65 + .../node_modules/safe-buffer/package.json | 51 + .../node_modules/safer-buffer/LICENSE | 21 + .../safer-buffer/Porting-Buffer.md | 268 + .../node_modules/safer-buffer/Readme.md | 156 + .../node_modules/safer-buffer/dangerous.js | 58 + .../node_modules/safer-buffer/package.json | 34 + .../node_modules/safer-buffer/safer.js | 77 + .../node_modules/safer-buffer/tests.js | 406 + .../node_modules/send/HISTORY.md | 538 ++ .../ExpressServer/node_modules/send/LICENSE | 23 + .../ExpressServer/node_modules/send/README.md | 327 + .../node_modules/send/SECURITY.md | 24 + .../ExpressServer/node_modules/send/index.js | 1142 +++ .../send/node_modules/ms/index.js | 162 + .../send/node_modules/ms/license.md | 21 + .../send/node_modules/ms/package.json | 38 + .../send/node_modules/ms/readme.md | 59 + .../node_modules/send/package.json | 62 + .../node_modules/serve-static/HISTORY.md | 493 + .../node_modules/serve-static/LICENSE | 25 + .../node_modules/serve-static/README.md | 257 + .../node_modules/serve-static/index.js | 209 + .../node_modules/serve-static/package.json | 42 + .../node_modules/setprototypeof/LICENSE | 13 + .../node_modules/setprototypeof/README.md | 31 + .../node_modules/setprototypeof/index.d.ts | 2 + .../node_modules/setprototypeof/index.js | 17 + .../node_modules/setprototypeof/package.json | 38 + .../node_modules/setprototypeof/test/index.js | 24 + .../side-channel-list/.editorconfig | 9 + .../node_modules/side-channel-list/.eslintrc | 11 + .../side-channel-list/.github/FUNDING.yml | 12 + .../node_modules/side-channel-list/.nycrc | 13 + .../side-channel-list/CHANGELOG.md | 15 + .../node_modules/side-channel-list/LICENSE | 21 + .../node_modules/side-channel-list/README.md | 62 + .../node_modules/side-channel-list/index.d.ts | 13 + .../node_modules/side-channel-list/index.js | 113 + .../node_modules/side-channel-list/list.d.ts | 14 + .../side-channel-list/package.json | 77 + .../side-channel-list/test/index.js | 104 + .../side-channel-list/tsconfig.json | 9 + .../side-channel-map/.editorconfig | 9 + .../node_modules/side-channel-map/.eslintrc | 11 + .../side-channel-map/.github/FUNDING.yml | 12 + .../node_modules/side-channel-map/.nycrc | 13 + .../side-channel-map/CHANGELOG.md | 22 + .../node_modules/side-channel-map/LICENSE | 21 + .../node_modules/side-channel-map/README.md | 62 + .../node_modules/side-channel-map/index.d.ts | 15 + .../node_modules/side-channel-map/index.js | 68 + .../side-channel-map/package.json | 80 + .../side-channel-map/test/index.js | 114 + .../side-channel-map/tsconfig.json | 9 + .../side-channel-weakmap/.editorconfig | 9 + .../side-channel-weakmap/.eslintrc | 12 + .../side-channel-weakmap/.github/FUNDING.yml | 12 + .../node_modules/side-channel-weakmap/.nycrc | 13 + .../side-channel-weakmap/CHANGELOG.md | 28 + .../node_modules/side-channel-weakmap/LICENSE | 21 + .../side-channel-weakmap/README.md | 62 + .../side-channel-weakmap/index.d.ts | 15 + .../side-channel-weakmap/index.js | 84 + .../side-channel-weakmap/package.json | 87 + .../side-channel-weakmap/test/index.js | 114 + .../side-channel-weakmap/tsconfig.json | 9 + .../node_modules/side-channel/.editorconfig | 9 + .../node_modules/side-channel/.eslintrc | 12 + .../side-channel/.github/FUNDING.yml | 12 + .../node_modules/side-channel/.nycrc | 13 + .../node_modules/side-channel/CHANGELOG.md | 110 + .../node_modules/side-channel/LICENSE | 21 + .../node_modules/side-channel/README.md | 61 + .../node_modules/side-channel/index.d.ts | 14 + .../node_modules/side-channel/index.js | 43 + .../node_modules/side-channel/package.json | 85 + .../node_modules/side-channel/test/index.js | 104 + .../node_modules/side-channel/tsconfig.json | 9 + .../node_modules/statuses/HISTORY.md | 87 + .../node_modules/statuses/LICENSE | 23 + .../node_modules/statuses/README.md | 139 + .../node_modules/statuses/codes.json | 65 + .../node_modules/statuses/index.js | 146 + .../node_modules/statuses/package.json | 49 + .../node_modules/toidentifier/HISTORY.md | 9 + .../node_modules/toidentifier/LICENSE | 21 + .../node_modules/toidentifier/README.md | 61 + .../node_modules/toidentifier/index.js | 32 + .../node_modules/toidentifier/package.json | 38 + .../node_modules/type-is/HISTORY.md | 259 + .../node_modules/type-is/LICENSE | 23 + .../node_modules/type-is/README.md | 170 + .../node_modules/type-is/index.js | 266 + .../node_modules/type-is/package.json | 45 + .../node_modules/unpipe/HISTORY.md | 4 + .../ExpressServer/node_modules/unpipe/LICENSE | 22 + .../node_modules/unpipe/README.md | 43 + .../node_modules/unpipe/index.js | 69 + .../node_modules/unpipe/package.json | 27 + .../node_modules/utils-merge/.npmignore | 9 + .../node_modules/utils-merge/LICENSE | 20 + .../node_modules/utils-merge/README.md | 34 + .../node_modules/utils-merge/index.js | 23 + .../node_modules/utils-merge/package.json | 40 + .../node_modules/vary/HISTORY.md | 39 + .../ExpressServer/node_modules/vary/LICENSE | 22 + .../ExpressServer/node_modules/vary/README.md | 101 + .../ExpressServer/node_modules/vary/index.js | 149 + .../node_modules/vary/package.json | 43 + src/Servers/ExpressServer/package-lock.json | 757 ++ src/Servers/ExpressServer/server.js | 6 +- src/Servers/FastHttpServer/main.go | 4 + src/Servers/FlaskServer/app.py | 4 +- .../GenHttpServer/GenHttpServer.csproj | 1 + src/Servers/GenHttpServer/Program.cs | 22 +- src/Servers/GinServer/main.go | 6 + src/Servers/GlyphServer/Program.cs | 29 +- .../__pycache__/app.cpython-312.pyc | Bin 0 -> 790 bytes src/Servers/GunicornServer/app.py | 7 + src/Servers/H2OServer/h2o.conf | 9 +- src/Servers/HyperServer/src/main.rs | 9 +- .../src/main/java/server/Application.java | 9 +- src/Servers/LighttpdServer/index.cgi | 7 +- src/Servers/NancyServer/Program.cs | 10 +- src/Servers/NetCoreServerFramework/Program.cs | 5 +- src/Servers/NodeServer/server.js | 13 +- src/Servers/NtexServer/src/main.rs | 15 +- src/Servers/PhpServer/index.php | 6 +- src/Servers/PingoraServer/src/main.rs | 14 +- src/Servers/PumaServer/config.ru | 9 +- .../src/main/java/server/Application.java | 7 +- src/Servers/ServiceStackServer/Program.cs | 11 +- src/Servers/SimpleWServer/Program.cs | 4 +- src/Servers/SiskServer/Program.cs | 5 + .../src/main/java/server/Application.java | 13 +- src/Servers/TomcatServer/webapp/ok.jsp | 10 +- .../__pycache__/app.cpython-312.pyc | Bin 0 -> 1038 bytes src/Servers/UvicornServer/app.py | 11 +- src/Servers/WatsonServer/Program.cs | 11 +- 645 files changed, 66129 insertions(+), 57 deletions(-) create mode 100644 docs/static/probe/data.js create mode 120000 src/Servers/ExpressServer/node_modules/.bin/mime create mode 100644 src/Servers/ExpressServer/node_modules/.package-lock.json create mode 100644 src/Servers/ExpressServer/node_modules/accepts/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/accepts/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/accepts/README.md create mode 100644 src/Servers/ExpressServer/node_modules/accepts/index.js create mode 100644 src/Servers/ExpressServer/node_modules/accepts/package.json create mode 100644 src/Servers/ExpressServer/node_modules/array-flatten/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/array-flatten/README.md create mode 100644 src/Servers/ExpressServer/node_modules/array-flatten/array-flatten.js create mode 100644 src/Servers/ExpressServer/node_modules/array-flatten/package.json create mode 100644 src/Servers/ExpressServer/node_modules/body-parser/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/body-parser/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/body-parser/README.md create mode 100644 src/Servers/ExpressServer/node_modules/body-parser/index.js create mode 100644 src/Servers/ExpressServer/node_modules/body-parser/lib/read.js create mode 100644 src/Servers/ExpressServer/node_modules/body-parser/lib/types/json.js create mode 100644 src/Servers/ExpressServer/node_modules/body-parser/lib/types/raw.js create mode 100644 src/Servers/ExpressServer/node_modules/body-parser/lib/types/text.js create mode 100644 src/Servers/ExpressServer/node_modules/body-parser/lib/types/urlencoded.js create mode 100644 src/Servers/ExpressServer/node_modules/body-parser/package.json create mode 100644 src/Servers/ExpressServer/node_modules/bytes/History.md create mode 100644 src/Servers/ExpressServer/node_modules/bytes/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/bytes/Readme.md create mode 100644 src/Servers/ExpressServer/node_modules/bytes/index.js create mode 100644 src/Servers/ExpressServer/node_modules/bytes/package.json create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/README.md create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/actualApply.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/actualApply.js create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/applyBind.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/applyBind.js create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionApply.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionApply.js create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionCall.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionCall.js create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/index.js create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/package.json create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/reflectApply.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/reflectApply.js create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/README.md create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/index.js create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/package.json create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/call-bound/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/content-disposition/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/content-disposition/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/content-disposition/README.md create mode 100644 src/Servers/ExpressServer/node_modules/content-disposition/index.js create mode 100644 src/Servers/ExpressServer/node_modules/content-disposition/package.json create mode 100644 src/Servers/ExpressServer/node_modules/content-type/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/content-type/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/content-type/README.md create mode 100644 src/Servers/ExpressServer/node_modules/content-type/index.js create mode 100644 src/Servers/ExpressServer/node_modules/content-type/package.json create mode 100644 src/Servers/ExpressServer/node_modules/cookie-signature/History.md create mode 100644 src/Servers/ExpressServer/node_modules/cookie-signature/Readme.md create mode 100644 src/Servers/ExpressServer/node_modules/cookie-signature/index.js create mode 100644 src/Servers/ExpressServer/node_modules/cookie-signature/package.json create mode 100644 src/Servers/ExpressServer/node_modules/cookie/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/cookie/README.md create mode 100644 src/Servers/ExpressServer/node_modules/cookie/SECURITY.md create mode 100644 src/Servers/ExpressServer/node_modules/cookie/index.js create mode 100644 src/Servers/ExpressServer/node_modules/cookie/package.json create mode 100644 src/Servers/ExpressServer/node_modules/depd/History.md create mode 100644 src/Servers/ExpressServer/node_modules/depd/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/depd/Readme.md create mode 100644 src/Servers/ExpressServer/node_modules/depd/index.js create mode 100644 src/Servers/ExpressServer/node_modules/depd/lib/browser/index.js create mode 100644 src/Servers/ExpressServer/node_modules/depd/package.json create mode 100644 src/Servers/ExpressServer/node_modules/destroy/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/destroy/README.md create mode 100644 src/Servers/ExpressServer/node_modules/destroy/index.js create mode 100644 src/Servers/ExpressServer/node_modules/destroy/package.json create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/README.md create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/get.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/get.js create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/package.json create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/set.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/set.js create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/test/get.js create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/test/set.js create mode 100644 src/Servers/ExpressServer/node_modules/dunder-proto/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/ee-first/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/ee-first/README.md create mode 100644 src/Servers/ExpressServer/node_modules/ee-first/index.js create mode 100644 src/Servers/ExpressServer/node_modules/ee-first/package.json create mode 100644 src/Servers/ExpressServer/node_modules/encodeurl/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/encodeurl/README.md create mode 100644 src/Servers/ExpressServer/node_modules/encodeurl/index.js create mode 100644 src/Servers/ExpressServer/node_modules/encodeurl/package.json create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/README.md create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/index.js create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/package.json create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/es-define-property/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/README.md create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/eval.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/eval.js create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/index.js create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/package.json create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/range.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/range.js create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/ref.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/ref.js create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/syntax.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/syntax.js create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/type.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/type.js create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/uri.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-errors/uri.js create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/README.md create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/RequireObjectCoercible.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/RequireObjectCoercible.js create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/ToObject.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/ToObject.js create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/index.js create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/isObject.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/isObject.js create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/package.json create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/es-object-atoms/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/escape-html/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/escape-html/Readme.md create mode 100644 src/Servers/ExpressServer/node_modules/escape-html/index.js create mode 100644 src/Servers/ExpressServer/node_modules/escape-html/package.json create mode 100644 src/Servers/ExpressServer/node_modules/etag/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/etag/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/etag/README.md create mode 100644 src/Servers/ExpressServer/node_modules/etag/index.js create mode 100644 src/Servers/ExpressServer/node_modules/etag/package.json create mode 100644 src/Servers/ExpressServer/node_modules/express/History.md create mode 100644 src/Servers/ExpressServer/node_modules/express/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/express/Readme.md create mode 100644 src/Servers/ExpressServer/node_modules/express/index.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/application.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/express.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/middleware/init.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/middleware/query.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/request.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/response.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/router/index.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/router/layer.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/router/route.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/utils.js create mode 100644 src/Servers/ExpressServer/node_modules/express/lib/view.js create mode 100644 src/Servers/ExpressServer/node_modules/express/package.json create mode 100644 src/Servers/ExpressServer/node_modules/finalhandler/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/finalhandler/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/finalhandler/README.md create mode 100644 src/Servers/ExpressServer/node_modules/finalhandler/SECURITY.md create mode 100644 src/Servers/ExpressServer/node_modules/finalhandler/index.js create mode 100644 src/Servers/ExpressServer/node_modules/finalhandler/package.json create mode 100644 src/Servers/ExpressServer/node_modules/forwarded/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/forwarded/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/forwarded/README.md create mode 100644 src/Servers/ExpressServer/node_modules/forwarded/index.js create mode 100644 src/Servers/ExpressServer/node_modules/forwarded/package.json create mode 100644 src/Servers/ExpressServer/node_modules/fresh/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/fresh/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/fresh/README.md create mode 100644 src/Servers/ExpressServer/node_modules/fresh/index.js create mode 100644 src/Servers/ExpressServer/node_modules/fresh/package.json create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/.github/SECURITY.md create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/README.md create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/implementation.js create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/index.js create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/package.json create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/test/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/function-bind/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/get-intrinsic/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/get-intrinsic/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/get-intrinsic/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/get-intrinsic/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/get-intrinsic/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/get-intrinsic/README.md create mode 100644 src/Servers/ExpressServer/node_modules/get-intrinsic/index.js create mode 100644 src/Servers/ExpressServer/node_modules/get-intrinsic/package.json create mode 100644 src/Servers/ExpressServer/node_modules/get-intrinsic/test/GetIntrinsic.js create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/Object.getPrototypeOf.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/Object.getPrototypeOf.js create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/README.md create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/Reflect.getPrototypeOf.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/Reflect.getPrototypeOf.js create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/index.js create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/package.json create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/get-proto/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/gopd/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/gopd/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/gopd/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/gopd/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/gopd/README.md create mode 100644 src/Servers/ExpressServer/node_modules/gopd/gOPD.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/gopd/gOPD.js create mode 100644 src/Servers/ExpressServer/node_modules/gopd/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/gopd/index.js create mode 100644 src/Servers/ExpressServer/node_modules/gopd/package.json create mode 100644 src/Servers/ExpressServer/node_modules/gopd/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/gopd/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/README.md create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/index.js create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/package.json create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/shams.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/shams.js create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/test/shams/core-js.js create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/test/shams/get-own-property-symbols.js create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/test/tests.js create mode 100644 src/Servers/ExpressServer/node_modules/has-symbols/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/hasown/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/hasown/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/hasown/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/hasown/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/hasown/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/hasown/README.md create mode 100644 src/Servers/ExpressServer/node_modules/hasown/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/hasown/index.js create mode 100644 src/Servers/ExpressServer/node_modules/hasown/package.json create mode 100644 src/Servers/ExpressServer/node_modules/hasown/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/http-errors/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/http-errors/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/http-errors/README.md create mode 100644 src/Servers/ExpressServer/node_modules/http-errors/index.js create mode 100644 src/Servers/ExpressServer/node_modules/http-errors/package.json create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/Changelog.md create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/README.md create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/dbcs-codec.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/dbcs-data.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/index.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/internal.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/sbcs-codec.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/sbcs-data-generated.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/sbcs-data.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/tables/big5-added.json create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/tables/cp936.json create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/tables/cp949.json create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/tables/cp950.json create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/tables/eucjp.json create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/tables/gb18030-ranges.json create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/tables/gbk-added.json create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/tables/shiftjis.json create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/utf16.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/encodings/utf7.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/lib/bom-handling.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/lib/extend-node.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/lib/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/lib/index.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/lib/streams.js create mode 100644 src/Servers/ExpressServer/node_modules/iconv-lite/package.json create mode 100644 src/Servers/ExpressServer/node_modules/inherits/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/inherits/README.md create mode 100644 src/Servers/ExpressServer/node_modules/inherits/inherits.js create mode 100644 src/Servers/ExpressServer/node_modules/inherits/inherits_browser.js create mode 100644 src/Servers/ExpressServer/node_modules/inherits/package.json create mode 100644 src/Servers/ExpressServer/node_modules/ipaddr.js/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/ipaddr.js/README.md create mode 100644 src/Servers/ExpressServer/node_modules/ipaddr.js/ipaddr.min.js create mode 100644 src/Servers/ExpressServer/node_modules/ipaddr.js/lib/ipaddr.js create mode 100644 src/Servers/ExpressServer/node_modules/ipaddr.js/lib/ipaddr.js.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/ipaddr.js/package.json create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/README.md create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/abs.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/abs.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/constants/maxArrayLength.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/constants/maxArrayLength.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/constants/maxSafeInteger.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/constants/maxSafeInteger.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/constants/maxValue.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/constants/maxValue.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/floor.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/floor.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/isFinite.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/isFinite.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/isInteger.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/isInteger.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/isNaN.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/isNaN.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/isNegativeZero.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/isNegativeZero.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/max.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/max.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/min.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/min.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/mod.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/mod.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/package.json create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/pow.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/pow.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/round.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/round.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/sign.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/sign.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/math-intrinsics/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/media-typer/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/media-typer/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/media-typer/README.md create mode 100644 src/Servers/ExpressServer/node_modules/media-typer/index.js create mode 100644 src/Servers/ExpressServer/node_modules/media-typer/package.json create mode 100644 src/Servers/ExpressServer/node_modules/merge-descriptors/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/merge-descriptors/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/merge-descriptors/README.md create mode 100644 src/Servers/ExpressServer/node_modules/merge-descriptors/index.js create mode 100644 src/Servers/ExpressServer/node_modules/merge-descriptors/package.json create mode 100644 src/Servers/ExpressServer/node_modules/methods/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/methods/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/methods/README.md create mode 100644 src/Servers/ExpressServer/node_modules/methods/index.js create mode 100644 src/Servers/ExpressServer/node_modules/methods/package.json create mode 100644 src/Servers/ExpressServer/node_modules/mime-db/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/mime-db/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/mime-db/README.md create mode 100644 src/Servers/ExpressServer/node_modules/mime-db/db.json create mode 100644 src/Servers/ExpressServer/node_modules/mime-db/index.js create mode 100644 src/Servers/ExpressServer/node_modules/mime-db/package.json create mode 100644 src/Servers/ExpressServer/node_modules/mime-types/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/mime-types/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/mime-types/README.md create mode 100644 src/Servers/ExpressServer/node_modules/mime-types/index.js create mode 100644 src/Servers/ExpressServer/node_modules/mime-types/package.json create mode 100644 src/Servers/ExpressServer/node_modules/mime/.npmignore create mode 100644 src/Servers/ExpressServer/node_modules/mime/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/mime/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/mime/README.md create mode 100755 src/Servers/ExpressServer/node_modules/mime/cli.js create mode 100644 src/Servers/ExpressServer/node_modules/mime/mime.js create mode 100644 src/Servers/ExpressServer/node_modules/mime/package.json create mode 100755 src/Servers/ExpressServer/node_modules/mime/src/build.js create mode 100644 src/Servers/ExpressServer/node_modules/mime/src/test.js create mode 100644 src/Servers/ExpressServer/node_modules/mime/types.json create mode 100644 src/Servers/ExpressServer/node_modules/ms/index.js create mode 100644 src/Servers/ExpressServer/node_modules/ms/license.md create mode 100644 src/Servers/ExpressServer/node_modules/ms/package.json create mode 100644 src/Servers/ExpressServer/node_modules/ms/readme.md create mode 100644 src/Servers/ExpressServer/node_modules/negotiator/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/negotiator/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/negotiator/README.md create mode 100644 src/Servers/ExpressServer/node_modules/negotiator/index.js create mode 100644 src/Servers/ExpressServer/node_modules/negotiator/lib/charset.js create mode 100644 src/Servers/ExpressServer/node_modules/negotiator/lib/encoding.js create mode 100644 src/Servers/ExpressServer/node_modules/negotiator/lib/language.js create mode 100644 src/Servers/ExpressServer/node_modules/negotiator/lib/mediaType.js create mode 100644 src/Servers/ExpressServer/node_modules/negotiator/package.json create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/example/all.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/example/circular.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/example/fn.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/example/inspect.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/index.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/package-support.json create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/package.json create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/readme.markdown create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test-core-js.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/bigint.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/browser/dom.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/circular.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/deep.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/element.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/err.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/fakes.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/fn.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/global.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/has.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/holes.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/indent-option.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/inspect.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/lowbyte.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/number.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/quoteStyle.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/toStringTag.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/undef.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/test/values.js create mode 100644 src/Servers/ExpressServer/node_modules/object-inspect/util.inspect.js create mode 100644 src/Servers/ExpressServer/node_modules/on-finished/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/on-finished/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/on-finished/README.md create mode 100644 src/Servers/ExpressServer/node_modules/on-finished/index.js create mode 100644 src/Servers/ExpressServer/node_modules/on-finished/package.json create mode 100644 src/Servers/ExpressServer/node_modules/parseurl/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/parseurl/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/parseurl/README.md create mode 100644 src/Servers/ExpressServer/node_modules/parseurl/index.js create mode 100644 src/Servers/ExpressServer/node_modules/parseurl/package.json create mode 100644 src/Servers/ExpressServer/node_modules/path-to-regexp/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/path-to-regexp/Readme.md create mode 100644 src/Servers/ExpressServer/node_modules/path-to-regexp/index.js create mode 100644 src/Servers/ExpressServer/node_modules/path-to-regexp/package.json create mode 100644 src/Servers/ExpressServer/node_modules/proxy-addr/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/proxy-addr/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/proxy-addr/README.md create mode 100644 src/Servers/ExpressServer/node_modules/proxy-addr/index.js create mode 100644 src/Servers/ExpressServer/node_modules/proxy-addr/package.json create mode 100644 src/Servers/ExpressServer/node_modules/qs/.editorconfig create mode 100644 src/Servers/ExpressServer/node_modules/qs/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/qs/.github/SECURITY.md create mode 100644 src/Servers/ExpressServer/node_modules/qs/.github/THREAT_MODEL.md create mode 100644 src/Servers/ExpressServer/node_modules/qs/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/qs/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/qs/LICENSE.md create mode 100644 src/Servers/ExpressServer/node_modules/qs/README.md create mode 100644 src/Servers/ExpressServer/node_modules/qs/dist/qs.js create mode 100644 src/Servers/ExpressServer/node_modules/qs/eslint.config.mjs create mode 100644 src/Servers/ExpressServer/node_modules/qs/lib/formats.js create mode 100644 src/Servers/ExpressServer/node_modules/qs/lib/index.js create mode 100644 src/Servers/ExpressServer/node_modules/qs/lib/parse.js create mode 100644 src/Servers/ExpressServer/node_modules/qs/lib/stringify.js create mode 100644 src/Servers/ExpressServer/node_modules/qs/lib/utils.js create mode 100644 src/Servers/ExpressServer/node_modules/qs/package.json create mode 100644 src/Servers/ExpressServer/node_modules/qs/test/empty-keys-cases.js create mode 100644 src/Servers/ExpressServer/node_modules/qs/test/parse.js create mode 100644 src/Servers/ExpressServer/node_modules/qs/test/stringify.js create mode 100644 src/Servers/ExpressServer/node_modules/qs/test/utils.js create mode 100644 src/Servers/ExpressServer/node_modules/range-parser/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/range-parser/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/range-parser/README.md create mode 100644 src/Servers/ExpressServer/node_modules/range-parser/index.js create mode 100644 src/Servers/ExpressServer/node_modules/range-parser/package.json create mode 100644 src/Servers/ExpressServer/node_modules/raw-body/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/raw-body/README.md create mode 100644 src/Servers/ExpressServer/node_modules/raw-body/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/raw-body/index.js create mode 100644 src/Servers/ExpressServer/node_modules/raw-body/package.json create mode 100644 src/Servers/ExpressServer/node_modules/safe-buffer/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/safe-buffer/README.md create mode 100644 src/Servers/ExpressServer/node_modules/safe-buffer/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/safe-buffer/index.js create mode 100644 src/Servers/ExpressServer/node_modules/safe-buffer/package.json create mode 100644 src/Servers/ExpressServer/node_modules/safer-buffer/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/safer-buffer/Porting-Buffer.md create mode 100644 src/Servers/ExpressServer/node_modules/safer-buffer/Readme.md create mode 100644 src/Servers/ExpressServer/node_modules/safer-buffer/dangerous.js create mode 100644 src/Servers/ExpressServer/node_modules/safer-buffer/package.json create mode 100644 src/Servers/ExpressServer/node_modules/safer-buffer/safer.js create mode 100644 src/Servers/ExpressServer/node_modules/safer-buffer/tests.js create mode 100644 src/Servers/ExpressServer/node_modules/send/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/send/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/send/README.md create mode 100644 src/Servers/ExpressServer/node_modules/send/SECURITY.md create mode 100644 src/Servers/ExpressServer/node_modules/send/index.js create mode 100644 src/Servers/ExpressServer/node_modules/send/node_modules/ms/index.js create mode 100644 src/Servers/ExpressServer/node_modules/send/node_modules/ms/license.md create mode 100644 src/Servers/ExpressServer/node_modules/send/node_modules/ms/package.json create mode 100644 src/Servers/ExpressServer/node_modules/send/node_modules/ms/readme.md create mode 100644 src/Servers/ExpressServer/node_modules/send/package.json create mode 100644 src/Servers/ExpressServer/node_modules/serve-static/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/serve-static/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/serve-static/README.md create mode 100644 src/Servers/ExpressServer/node_modules/serve-static/index.js create mode 100644 src/Servers/ExpressServer/node_modules/serve-static/package.json create mode 100644 src/Servers/ExpressServer/node_modules/setprototypeof/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/setprototypeof/README.md create mode 100644 src/Servers/ExpressServer/node_modules/setprototypeof/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/setprototypeof/index.js create mode 100644 src/Servers/ExpressServer/node_modules/setprototypeof/package.json create mode 100644 src/Servers/ExpressServer/node_modules/setprototypeof/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/.editorconfig create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/README.md create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/index.js create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/list.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/package.json create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-list/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/.editorconfig create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/README.md create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/index.js create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/package.json create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-map/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/.editorconfig create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/README.md create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/index.js create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/package.json create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/side-channel-weakmap/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/.editorconfig create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/.eslintrc create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/.github/FUNDING.yml create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/.nycrc create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/CHANGELOG.md create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/README.md create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/index.d.ts create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/index.js create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/package.json create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/test/index.js create mode 100644 src/Servers/ExpressServer/node_modules/side-channel/tsconfig.json create mode 100644 src/Servers/ExpressServer/node_modules/statuses/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/statuses/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/statuses/README.md create mode 100644 src/Servers/ExpressServer/node_modules/statuses/codes.json create mode 100644 src/Servers/ExpressServer/node_modules/statuses/index.js create mode 100644 src/Servers/ExpressServer/node_modules/statuses/package.json create mode 100644 src/Servers/ExpressServer/node_modules/toidentifier/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/toidentifier/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/toidentifier/README.md create mode 100644 src/Servers/ExpressServer/node_modules/toidentifier/index.js create mode 100644 src/Servers/ExpressServer/node_modules/toidentifier/package.json create mode 100644 src/Servers/ExpressServer/node_modules/type-is/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/type-is/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/type-is/README.md create mode 100644 src/Servers/ExpressServer/node_modules/type-is/index.js create mode 100644 src/Servers/ExpressServer/node_modules/type-is/package.json create mode 100644 src/Servers/ExpressServer/node_modules/unpipe/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/unpipe/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/unpipe/README.md create mode 100644 src/Servers/ExpressServer/node_modules/unpipe/index.js create mode 100644 src/Servers/ExpressServer/node_modules/unpipe/package.json create mode 100644 src/Servers/ExpressServer/node_modules/utils-merge/.npmignore create mode 100644 src/Servers/ExpressServer/node_modules/utils-merge/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/utils-merge/README.md create mode 100644 src/Servers/ExpressServer/node_modules/utils-merge/index.js create mode 100644 src/Servers/ExpressServer/node_modules/utils-merge/package.json create mode 100644 src/Servers/ExpressServer/node_modules/vary/HISTORY.md create mode 100644 src/Servers/ExpressServer/node_modules/vary/LICENSE create mode 100644 src/Servers/ExpressServer/node_modules/vary/README.md create mode 100644 src/Servers/ExpressServer/node_modules/vary/index.js create mode 100644 src/Servers/ExpressServer/node_modules/vary/package.json create mode 100644 src/Servers/ExpressServer/package-lock.json create mode 100644 src/Servers/GunicornServer/__pycache__/app.cpython-312.pyc create mode 100644 src/Servers/UvicornServer/__pycache__/app.cpython-312.pyc diff --git a/.github/workflows/probe.yml b/.github/workflows/probe.yml index 332e8be..22613ca 100644 --- a/.github/workflows/probe.yml +++ b/.github/workflows/probe.yml @@ -156,6 +156,9 @@ jobs: 'connectionState': conn, 'reason': reason, 'scored': scored, 'durationMs': r.get('durationMs', 0), + 'rawRequest': r.get('rawRequest'), + 'rawResponse': r.get('rawResponse'), + 'behavioralNote': r.get('behavioralNote'), }) scored_results = [r for r in results if r['scored']] diff --git a/docs/hugo.yaml b/docs/hugo.yaml index f96ab52..db64c5a 100644 --- a/docs/hugo.yaml +++ b/docs/hugo.yaml @@ -41,8 +41,13 @@ menu: weight: 8 params: type: theme-toggle - - name: GitHub + - name: Discord weight: 9 + url: https://discord.gg/H84B5ZqDXR + params: + icon: discord + - name: GitHub + weight: 10 url: https://github.com/MDA2AV/Http11Probe params: icon: github diff --git a/docs/static/probe/data.js b/docs/static/probe/data.js new file mode 100644 index 0000000..35330dc --- /dev/null +++ b/docs/static/probe/data.js @@ -0,0 +1 @@ +window.PROBE_DATA = {"commit": {"id": "acfa55caef2f31a94883ee9c52c9ee97235b349a", "message": "Merge pull request #21 from MDA2AV/fix/adjust-bare-lf", "timestamp": "2026-02-12T18:31:51+00:00"}, "servers": [{"summary": {"total": 143, "scored": 125, "passed": 93, "failed": 15, "warnings": 17, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 63.9613, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.8521, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.7311, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 51.7214, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.6919, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 50.9083, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.6966, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 505, "expected": "400/505 or close", "got": "505", "connectionState": "ClosedByServer", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.8775, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 505 HTTP Version Not Supported\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.6139, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.5972, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.5834, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 404, "expected": "400 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 404 \u2014 Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 51.238, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 50.834, "rawRequest": "GET /\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.6348, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 50.6964, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.8738, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 50.8284, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with plus sign must be rejected", "scored": true, "durationMs": 52.5229, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 50.5472, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:53 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.7728, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.8696, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Host header with path component must be rejected", "scored": true, "durationMs": 50.4779, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 405, "expected": "400 or close", "got": "405", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 405 \u2014 Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.5336, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\nAllow: OPTIONS\r\n\r\n", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 405, "expected": "2xx", "got": "405", "connectionState": "Open", "reason": "Expected 2xx, got 405 \u2014 OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 50.5558, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nContent-Length: 0\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\nAllow: GET, POST\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400/501 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 50.7638, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 51.0067, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 51.6673, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Warn", "statusCode": 200, "expected": "400/405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.6896, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 50.5437, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.4767, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.567, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:54 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5001.0418, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 51.8296, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:59 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 50.5902, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:59 GMT\r\nServer: Kestrel\r\n\r\nhello world", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 50.563, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:05:59 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5001.0627, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 50.8326, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:04 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 51.1047, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:04 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.553, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:04 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Pass", "statusCode": 405, "expected": "400/405/501 or close", "got": "405", "connectionState": "Open", "reason": "CONNECT to an origin server must be rejected", "scored": true, "durationMs": 50.6154, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nContent-Length: 0\r\nDate: Thu, 12 Feb 2026 21:06:04 GMT\r\nServer: Kestrel\r\nAllow: GET, POST\r\n\r\n", "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "417 or 2xx", "got": "200", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.4924, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:04 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.4628, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or 400", "got": "200", "connectionState": "Open", "reason": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 50.7131, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.5868, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Pass", "statusCode": 405, "expected": "405/501 or 2xx", "got": "405", "connectionState": "Open", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 50.6518, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nContent-Length: 0\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\nAllow: GET, POST\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 50.4216, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.6045, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.4746, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.3841, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.3768, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.6001, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 50.6256, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 50.4733, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Warn", "statusCode": 505, "expected": "200 or 505", "got": "505", "connectionState": "ClosedByServer", "reason": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 50.5612, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 505 HTTP Version Not Supported\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Pass", "statusCode": 405, "expected": "400/405 or 200", "got": "405", "connectionState": "Open", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.69, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nContent-Length: 0\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\nAllow: GET, POST\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 50.55, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.5699, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 10\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\nhelloworld", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 50.9074, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": "Used TE (chunked 0-length \u2192 empty body)"}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 50.5989, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.5974, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.6735, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:05 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 56.9713, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.3571, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.4327, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.4616, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 0.3813, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.4264, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.9583, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.5576, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 50.8788, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.3231, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.597, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 50.805, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 50.5703, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.7052, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 50.372, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.9501, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.3571, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 51.0878, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.4488, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.818, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.6808, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:06 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.5266, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with leading space must be rejected", "scored": true, "durationMs": 50.8318, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.7802, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 51.2805, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.7555, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.7244, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 50.4353, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 50.8682, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.4556, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.4942, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.4, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:07 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 5000.0705, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.3507, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:12 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative chunk size must be rejected", "scored": true, "durationMs": 50.6773, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:12 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.6048, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:12 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.5078, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:12 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.5134, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:12 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.463, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:12 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.5165, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:12 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.5979, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:12 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.8176, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:12 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.4916, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Fail", "statusCode": 405, "expected": "400 or 2xx", "got": "405", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 405 \u2014 HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.5122, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\nAllow: GET, POST\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Fail", "statusCode": 405, "expected": "400 or 2xx", "got": "405", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 405 \u2014 OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 50.4106, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nContent-Length: 0\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\nAllow: GET, POST\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.3345, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.3982, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.5182, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 50.6327, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 200\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 50.3608, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.6948, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 50.7319, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 50.7775, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.3249, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.6562, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.5449, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 50.7432, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 414, "expected": "400/414/431 or close", "got": "414", "connectionState": "ClosedByServer", "reason": "100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 51.0139, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 414 URI Too Long\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 50.9136, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 51.5534, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in URL should be rejected", "scored": true, "durationMs": 50.4295, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Control characters in header value should be rejected", "scored": true, "durationMs": 51.485, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:13 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5000.7124, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.452, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 50.7265, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 414, "expected": "400 or close", "got": "414", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 414 \u2014 100KB method name should be rejected", "scored": true, "durationMs": 50.9427, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 414 URI Too Long\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.6813, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.7907, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 50.5514, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 49.526, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in header value should be rejected", "scored": true, "durationMs": 50.3307, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 50.7695, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 Internal Server Error\r\nContent-Length: 0\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/505/close/timeout", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 0.363, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.4228, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.5968, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 50.4421, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 50.4549, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx/404", "got": "400", "connectionState": "ClosedByServer", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 50.5505, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 50.5531, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 50.9734, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 51.4104, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 413, "expected": "400/close/timeout", "got": "413", "connectionState": "ClosedByServer", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 51.0306, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": "HTTP/1.1 413 Payload Too Large\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:06:24 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}], "name": "ASP.NET Minimal", "language": "C#"}, {"summary": {"total": 143, "scored": 125, "passed": 37, "failed": 61, "warnings": 27, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 64.3781, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.7735, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.6053, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": null, "expected": "400", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Expected 400, got ClosedByServer \u2014 Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 0.3113, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.4123, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": null, "expected": "400 or 2xx", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 0.3401, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": null, "expected": "400", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Expected 400, got ClosedByServer \u2014 Request without Host header must be rejected with 400", "scored": true, "durationMs": 0.344, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 200, "expected": "400/505 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/505 or close, got 200 \u2014 Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.5644, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/9.9 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 0.3423, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": null, "expected": "400", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Expected 400, got ClosedByServer \u2014 CR without LF as line ending must be rejected", "scored": true, "durationMs": 0.1922, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 0.0994, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 51.1572, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 0.284, "rawRequest": "GET /\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.4229, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 0.2881, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.6508, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 51.2014, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with plus sign must be rejected", "scored": true, "durationMs": 51.7666, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\n", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 0.3487, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.6412, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:46 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.5834, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:47 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 50.6544, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:47 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 0.8217, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": null, "expected": "2xx", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Expected 2xx, got ClosedByServer \u2014 OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 0.2103, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400/501 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/501 or close, got 200 \u2014 Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 50.7134, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:47 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 50.9592, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:47 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 50.8956, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:47 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Warn", "statusCode": 200, "expected": "400/405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.797, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:47 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 50.7784, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:47 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.7095, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:47 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.7361, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:47 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5001.0906, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 50.7762, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 50.5748, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 50.7801, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400/close/timeout", "got": "200", "connectionState": "Open", "reason": "Expected 400/close/timeout, got 200 \u2014 Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 51.0933, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 50.8535, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 50.7361, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.8169, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Pass", "statusCode": null, "expected": "400/405/501 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "CONNECT to an origin server must be rejected", "scored": true, "durationMs": 0.3716, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "417 or 2xx", "got": "200", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.8932, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.8532, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or 400", "got": "200", "connectionState": "Open", "reason": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 50.8891, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.8855, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:52 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 50.867, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:53 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Empty Host header value must be rejected", "scored": true, "durationMs": 0.3747, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": null, "expected": "400 or 2xx", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 0.1832, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 0.6986, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 0.165, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 0.1544, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Fail", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "Open", "reason": "Expected 2xx + close, got 200 \u2014 Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.6109, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:53 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Warn", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "Open", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 51.0971, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:53 GMT\r\nConnection: keep-alive\r\n\r\n???OK", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "Open", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 55.6087, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.0 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:53 GMT\r\nConnection: keep-alive\r\n\r\n???OK", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Warn", "statusCode": 200, "expected": "200 or 505", "got": "200", "connectionState": "Open", "reason": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 50.6809, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.2 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:53 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "400/405 or 200", "got": "200", "connectionState": "Open", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.7968, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:53 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 50.7687, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:53 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.7982, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:53 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 5001.1998, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 51.4727, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:58 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\na\r\nhelloworld\r\n0\r\n\r\n", "behavioralNote": "Body: 3\r\n???\r\na\r\nhelloworld\r\n0"}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.7815, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:58 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.8256, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:58 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": "Body: 3\r\n???\r\n5\r\nhello\r\n0"}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 50.7274, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:58 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": "Body: 3\r\n???\r\n5\r\nhello\r\n0"}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.7069, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:58 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": "Body: 3\r\n???\r\n5\r\nhello\r\n0"}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 0.244, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.3495, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:06:58 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or close, got TimedOut \u2014 TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 5000.2989, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.742, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:03 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.5914, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:03 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\n", "behavioralNote": "Body: 3\r\n???\r\n5"}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.5761, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:03 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 50.5102, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:03 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": "Body: 3\r\n???"}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.3701, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:03 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.558, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:03 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 50.4028, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.0 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nConnection: keep-alive\r\n\r\n???", "behavioralNote": "Body: ???"}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 50.4824, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.6682, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 50.6301, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.5703, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.6253, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\n", "behavioralNote": "Body: 3\r\n???\r\n5"}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 50.666, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": "Body: 3\r\n???\r\n5\r\nhello\r\n0"}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.6127, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": "Body: 3\r\n???\r\n5\r\nhello\r\n0"}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.7414, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.8767, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.6687, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with leading space must be rejected", "scored": true, "durationMs": 50.4005, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.5308, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.7621, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.6888, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.7034, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 50.576, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 50.6333, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 49.6763, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": "Body: 3\r\n???"}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.5281, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:04 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": "Body: 3\r\n???"}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.8357, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": "Body: 3\r\n???"}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.6658, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.4198, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": "Body: 3\r\n???"}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Negative chunk size must be rejected", "scored": true, "durationMs": 50.4041, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.8277, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": "Body: 3\r\n???"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.5174, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.6123, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": "Body: 3\r\n???\r\n5\r\nhello\r\n0"}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Fail", "statusCode": 100, "expected": "400 or 2xx", "got": "100", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 100 \u2014 Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.5709, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 100 Continue\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.4987, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.5716, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.5196, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.5713, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.4708, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 50.5316, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.3814, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.4307, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.4829, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 50.5981, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": null, "expected": "400", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Expected 400, got ClosedByServer \u2014 Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 0.2049, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.4725, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": "Body: 3\r\n???"}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 50.6371, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": "Body: 3\r\n???"}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 50.5973, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:06 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.511, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:06 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.4016, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:06 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.6072, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:06 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 0.5196, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/414/431 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/414/431 or close, got 200 \u2014 100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 52.0159, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:06 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/431 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 0.4432, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/431 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 1.768, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in URL should be rejected", "scored": true, "durationMs": 50.5345, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:06 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Control characters in header value should be rejected", "scored": true, "durationMs": 50.4417, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:06 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5001.145, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.2467, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/431 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 0.4604, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 100KB method name should be rejected", "scored": true, "durationMs": 51.4514, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n2\r\nOK", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.5193, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.6458, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 50.3615, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 0.2699, "rawRequest": " \r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in header value should be rejected", "scored": true, "durationMs": 50.3026, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 50.3949, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/505/close/timeout", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 0.2355, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.26, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.5124, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 50.7833, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 50.3676, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 50.5167, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 50.8334, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 50.7678, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 50.4908, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nVary: Accept-Encoding\r\nContent-Encoding: identity\r\nContent-Type: text/plain; charset=utf-8\r\nServer: EmbedIO/3.5.2\r\nDate: Thu, 12 Feb 2026 21:07:17 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15,max=100\r\n\r\n3\r\n???\r\n", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5001.0565, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "EmbedIO", "language": "C#"}, {"summary": {"total": 143, "scored": 125, "passed": 93, "failed": 14, "warnings": 18, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 64.4801, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:24 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.9708, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:24 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 52.2787, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:24 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 52.0217, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.7755, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 50.8332, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.8459, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 505, "expected": "400/505 or close", "got": "505", "connectionState": "ClosedByServer", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 51.1186, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 505 HTTP Version Not Supported\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.9291, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.8973, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.9172, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 54.6011, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 50.7769, "rawRequest": "GET /\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.9095, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 50.6241, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.7631, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 51.0065, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with plus sign must be rejected", "scored": true, "durationMs": 52.608, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 50.6225, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.579, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.6911, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Host header with path component must be rejected", "scored": true, "durationMs": 50.6017, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:25 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 405, "expected": "400 or close", "got": "405", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 405 \u2014 Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.7305, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:26 GMT\r\nServer: Kestrel\r\nAllow: OPTIONS\r\n\r\n", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 50.8757, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:26 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400/501 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 50.641, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:26 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 51.386, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:26 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 51.9918, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:26 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Warn", "statusCode": 200, "expected": "400/405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 51.2473, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:26 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 50.6625, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:26 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.8321, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:26 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.707, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:26 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5001.2158, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 51.777, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:31 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 50.6944, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:31 GMT\r\nServer: Kestrel\r\n\r\nhello world", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 50.5012, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:31 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5000.467, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 50.9586, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:36 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 50.8909, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:36 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.7161, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:36 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Fail", "statusCode": 200, "expected": "400/405/501 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/405/501 or close, got 200 \u2014 CONNECT to an origin server must be rejected", "scored": true, "durationMs": 50.6353, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:36 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n", "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "417 or 2xx", "got": "200", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.6143, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:36 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.7231, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:36 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or 400", "got": "200", "connectionState": "Open", "reason": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 51.0463, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:36 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.6648, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:36 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 49.9036, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 50.7033, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.8671, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.6103, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.6228, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.58, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "Server must close connection after responding to Connection: close", "scored": true, "durationMs": 51.0132, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 50.6599, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 50.7088, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Warn", "statusCode": 505, "expected": "200 or 505", "got": "505", "connectionState": "ClosedByServer", "reason": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 50.6706, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 505 HTTP Version Not Supported\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "400/405 or 200", "got": "200", "connectionState": "Open", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.6557, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 50.7584, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.5519, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 10\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\nhelloworld", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 50.9255, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": "Used TE (chunked 0-length \u2192 empty body)"}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 50.6301, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.5755, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.7153, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 58.5966, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.803, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.545, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:37 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.7445, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 0.4043, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.4732, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.9619, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.8436, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 51.4282, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.5125, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.5629, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 50.8594, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 50.7972, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.4838, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 50.438, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 51.5078, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 51.0859, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 51.5125, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.4828, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 51.0528, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.5188, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.4488, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with leading space must be rejected", "scored": true, "durationMs": 50.9069, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.9564, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:38 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 51.2247, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:39 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.84, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:39 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.9952, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:39 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 50.5043, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:39 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 50.9341, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:39 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.5435, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:39 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.5554, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:39 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.8001, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:39 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 5000.0752, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.3928, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative chunk size must be rejected", "scored": true, "durationMs": 50.8306, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.76, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.5044, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.546, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.5372, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.8157, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.5525, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.6006, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.6276, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.6852, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 50.6402, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:44 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.4314, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.4324, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.7729, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 50.7375, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 200\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 50.364, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.8576, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 51.0947, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 50.6017, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.4665, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 51.145, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.9427, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 50.8779, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 414, "expected": "400/414/431 or close", "got": "414", "connectionState": "ClosedByServer", "reason": "100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 51.327, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 414 URI Too Long\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 51.1445, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 52.1356, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in URL should be rejected", "scored": true, "durationMs": 50.4819, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Control characters in header value should be rejected", "scored": true, "durationMs": 50.5536, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:45 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5000.9967, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.6596, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 50.821, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:55 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 414, "expected": "400 or close", "got": "414", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 414 \u2014 100KB method name should be rejected", "scored": true, "durationMs": 51.4029, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 414 URI Too Long\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:55 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.7683, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:55 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.7009, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 50.5294, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 50.5932, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in header value should be rejected", "scored": true, "durationMs": 50.434, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 51.0682, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 Internal Server Error\r\nContent-Length: 0\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/505/close/timeout", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 0.4447, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.5891, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.7394, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 50.9679, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 50.5508, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx/404", "got": "400", "connectionState": "ClosedByServer", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 50.5908, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 50.5902, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 51.929, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 51.5522, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n\"OK\"\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 413, "expected": "400/close/timeout", "got": "413", "connectionState": "ClosedByServer", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 51.4641, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": "HTTP/1.1 413 Payload Too Large\r\nContent-Length: 0\r\nConnection: close\r\nDate: Thu, 12 Feb 2026 21:07:56 GMT\r\nServer: Kestrel\r\n\r\n", "behavioralNote": null}], "name": "ServiceStack", "language": "C#"}, {"summary": {"total": 143, "scored": 125, "passed": 37, "failed": 63, "warnings": 25, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 63.5191, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.5126, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.614, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 50.4004, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.4281, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 51.1071, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.6765, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 200, "expected": "400/505 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/505 or close, got 200 \u2014 Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.5977, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.7725, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.3754, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.445, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 50.4698, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 5001.3604, "rawRequest": "GET /\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.3916, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Header line without colon must be rejected", "scored": true, "durationMs": 50.5183, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.6166, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 50.4561, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with plus sign must be rejected", "scored": true, "durationMs": 50.5674, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Whitespace before first header line must be rejected", "scored": true, "durationMs": 50.5923, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.6545, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.6255, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 50.4274, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.3512, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 50.6326, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400/501 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400/501 or close, got TimedOut \u2014 Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 5001.2737, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 50.4981, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 50.5966, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Fail", "statusCode": null, "expected": "400/405/501 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400/405/501 or 2xx, got TimedOut \u2014 Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 5001.5791, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 51.0864, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.5865, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": null, "expected": "2xx or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 5000.5495, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5000.7836, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 50.5449, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 15\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 50.9227, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 26\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 50.5233, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5000.9442, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Fail", "statusCode": null, "expected": "!101", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected !101, got TimedOut \u2014 WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 5000.3044, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 50.7769, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.5844, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Fail", "statusCode": null, "expected": "400/405/501 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400/405/501 or close, got TimedOut \u2014 CONNECT to an origin server must be rejected", "scored": true, "durationMs": 5001.1693, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "417 or 2xx", "got": "200", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.5932, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.4759, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or 400", "got": "200", "connectionState": "Open", "reason": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 50.5498, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 25\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.6774, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 50.7116, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 50.5393, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 5000.5504, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.3927, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.4493, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.4873, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Fail", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "Open", "reason": "Expected 2xx + close, got 200 \u2014 Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.4874, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Warn", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "Open", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 50.3474, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "Open", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 50.4578, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Warn", "statusCode": 200, "expected": "200 or 505", "got": "200", "connectionState": "Open", "reason": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 50.6558, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "400/405 or 200", "got": "200", "connectionState": "Open", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.802, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 50.6864, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 32\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.6547, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 20\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 5001.5699, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 50.969, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 10\r\n\r\nhelloworld", "behavioralNote": "Body: Content-Length: 10\r\n\r\nhelloworld"}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.4794, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.605, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 50.6944, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.4628, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.3812, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.4844, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 4\r\n\r\n0\r\n\r", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or close, got TimedOut \u2014 TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 5001.1093, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.9841, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.3643, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.4987, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 50.427, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.2745, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.2333, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 50.3484, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 50.3925, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 16\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.3286, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 50.3789, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.3412, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 28\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 5000.4025, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 50.7948, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.732, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.6196, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 17\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.7224, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.4991, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with leading space must be rejected", "scored": true, "durationMs": 50.5771, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 16\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.6041, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 13\r\n\r\n5\r\nhello0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.7357, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 15\r\n\r\n5;\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.9336, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 17\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.8636, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 14\r\n\r\n5\r\nhello\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 50.7226, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 20\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 50.7314, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 19\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.7689, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.6859, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.6594, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 5000.9136, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.5865, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Negative chunk size must be rejected", "scored": true, "durationMs": 50.5641, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 16\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.4299, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.4173, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.5059, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.5028, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.6183, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 35\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.3602, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 43\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.316, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 39\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.4099, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 43\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.3459, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 50.4016, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.3477, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.4989, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.4322, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 50.5358, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 50.547, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.7201, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 50.4874, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Body: Content-Length: 5\r\n\r\nhello"}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 51.5216, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.3366, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.3992, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 14\r\n\r\n5\rhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.4944, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 40\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 5001.1692, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/414/431 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/414/431 or close, got 200 \u2014 100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 51.0049, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/431 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/431 or close, got 200 \u2014 100KB header value should be rejected with 431", "scored": true, "durationMs": 50.808, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/431 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/431 or close, got 200 \u2014 10,000 headers should be rejected with 431", "scored": true, "durationMs": 52.2522, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in URL should be rejected", "scored": true, "durationMs": 50.3462, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Control characters in header value should be rejected", "scored": true, "durationMs": 50.3888, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5000.6353, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.5708, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/431 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/431 or close, got 200 \u2014 100KB header name should be rejected with 400/431", "scored": true, "durationMs": 51.4913, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or close, got TimedOut \u2014 100KB method name should be rejected", "scored": true, "durationMs": 5000.5432, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.3934, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.411, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 5000.2636, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 5000.2703, "rawRequest": " \r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in header value should be rejected", "scored": true, "durationMs": 50.4229, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 50.3448, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 31\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/505/close/timeout", "got": "200", "connectionState": "Open", "reason": "Expected 400/505/close/timeout, got 200 \u2014 HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 50.4745, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 5000.5358, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.6308, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 50.8525, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 51.3225, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 49.6858, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 50.7989, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 51.9701, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 65556\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 51.595, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5000.8277, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "NetCoreServer", "language": "C#"}, {"summary": {"total": 143, "scored": 125, "passed": 75, "failed": 32, "warnings": 18, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 63.5033, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.3799, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.5625, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 50.5445, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.5362, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 50.6879, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.2565, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 40\r\nConnection: close\r\n\r\n

Bad Request (Invalid host name)

", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 505, "expected": "400/505 or close", "got": "505", "connectionState": "Open", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.4323, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 505 Http Version Not Supported\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 64\r\n\r\n

Http Version Not Supported (Http Version Not Supported)

", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.4481, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.461, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.4874, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 52\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (parts).)

", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 50.6829, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 50.4506, "rawRequest": "GET /\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 52\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (parts).)

", "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.6697, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 104\r\nConnection: close\r\n\r\n

Bad Request (Specified value 'Bad[Name' has invalid HTTP Header characters. (Parameter 'name'))

", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 50.5028, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:55 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.5913, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 51.1327, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (The input string 'abc' was not in a correct format.)

", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with plus sign must be rejected", "scored": true, "durationMs": 51.1007, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 50.5618, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.7804, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.5007, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 50.6651, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.8171, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 58\r\nConnection: close\r\n\r\n

Bad Request (Invalid url: http://localhost:8080*)

", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 400, "expected": "2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Expected 2xx, got 400 \u2014 OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 50.7987, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 58\r\nConnection: close\r\n\r\n

Bad Request (Invalid url: http://localhost:8080*)

", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 501, "expected": "400/501 or close", "got": "501", "connectionState": "Open", "reason": "Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 50.8482, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 50.5891, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 50.5984, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Warn", "statusCode": 200, "expected": "400/405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.5363, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 50.4926, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.4292, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Fail", "statusCode": 411, "expected": "2xx or close", "got": "411", "connectionState": "ClosedByServer", "reason": "Expected 2xx or close, got 411 \u2014 POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.3962, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 411 Length Required\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:09:56 GMT\r\nContent-Length: 24\r\nConnection: close\r\n\r\n

Length Required

", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5000.8952, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 51.4415, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:01 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 50.6216, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:01 GMT\r\nContent-Length: 11\r\n\r\nhello world", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 50.468, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:01 GMT\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5000.9998, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 411, "expected": "!101", "got": "411", "connectionState": "ClosedByServer", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 50.6764, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 411 Length Required\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:06 GMT\r\nContent-Length: 24\r\nConnection: close\r\n\r\n

Length Required

", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 50.7966, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.6511, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Pass", "statusCode": 400, "expected": "400/405/501 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "CONNECT to an origin server must be rejected", "scored": true, "durationMs": 50.6827, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (Invalid url: http://example.com:8080example.com:443)

", "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "417 or 2xx", "got": "200", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.977, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.8667, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or 400", "got": "200", "connectionState": "Open", "reason": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 50.7826, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.591, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 50.4413, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Host header value must be rejected", "scored": true, "durationMs": 50.5397, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 40\r\nConnection: close\r\n\r\n

Bad Request (Invalid host name)

", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.6292, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 52\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (parts).)

", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.7173, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.4046, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.3698, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.9712, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 50.8411, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\nConnection: close\r\nKeep-Alive: true\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 51.4605, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\nConnection: close\r\nKeep-Alive: true\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Warn", "statusCode": 200, "expected": "200 or 505", "got": "200", "connectionState": "Open", "reason": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 49.7763, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "400/405 or 200", "got": "200", "connectionState": "Open", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.6088, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 50.3949, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.447, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:07 GMT\r\nContent-Length: 10\r\n\r\nhelloworld", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 50.701, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 0\r\n\r\n", "behavioralNote": "Used TE (chunked 0-length \u2192 empty body)"}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 50.5314, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 46\r\nConnection: close\r\n\r\n

Bad Request (Invalid Content-Length.)

", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.6376, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 501 \u2014 Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.6611, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

HTTP/1.1 404 Not Found\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 30\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Not Found (Not Found)

", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 50.544, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

", "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.6248, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.3688, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 46\r\nConnection: close\r\n\r\n

Bad Request (Invalid Content-Length.)

", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.4598, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 0.2281, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.3457, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.4349, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.4216, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 50.6288, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

\r\n", "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.5935, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 76\r\nConnection: close\r\n\r\n

Bad Request (The input string '5, 10' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "Open", "reason": "Expected 400 or close, got 501 \u2014 Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.4238, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 50.5095, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 5\r\nConnection: close\r\nKeep-Alive: true\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 50.7029, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.7019, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 50.4264, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (The input string '0o5' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.9023, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "Open", "reason": "Expected 400 or close, got 501 \u2014 Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.7524, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:08 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 50.756, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:09 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "Open", "reason": "Expected 400 or close, got 501 \u2014 Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.5554, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:09 GMT\r\nContent-Length: 42\r\n\r\n

Not Implemented (Not Implemented)

", "behavioralNote": null}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.7736, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:09 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.4233, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:09 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (The input string '0x5' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.5545, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:09 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (The input string '1 0' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with leading space must be rejected", "scored": true, "durationMs": 50.6092, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:09 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.4345, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:09 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n23\r\n

Bad Request (Expecting \\r)

\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 5000.678, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.4152, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:14 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n23\r\n

Bad Request (Expecting \\r)

", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.6052, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:14 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n23\r\n

Bad Request (Expecting \\r)

\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 50.6347, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:14 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 50.8026, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:14 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n21\r\n

Bad Request (2 CR found)

\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.5021, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:14 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

\r\n", "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.4251, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:14 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.4535, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:14 GMT\r\nContent-Length: 90\r\nConnection: close\r\n\r\n

Bad Request (Specified value has invalid Control characters. (Parameter 'value'))

", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 5000.7821, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "Open", "reason": "Expected 400 or close, got 501 \u2014 Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.5672, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:19 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Negative chunk size must be rejected", "scored": true, "durationMs": 50.3783, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:19 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.4397, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:19 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.4921, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:19 GMT\r\nContent-Length: 75\r\nConnection: close\r\n\r\n

Bad Request (The input string '5, 5' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.409, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:19 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Fail", "statusCode": 100, "expected": "400 or 2xx", "got": "100", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 100 \u2014 Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.3937, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 100 Continue\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.5483, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.5818, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.5645, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.8437, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.5677, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 50.6227, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.5771, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (The input string '1_0' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.642, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.5495, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 50.7211, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 50.5629, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.5604, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 50.5504, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

", "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 50.4726, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.3955, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.6415, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n21\r\n

Bad Request (2 CR found)

\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.7684, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 50.6062, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 52\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (parts).)

", "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/414/431 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/414/431 or close, got 200 \u2014 100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 52.028, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 50.6715, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:20 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 51.6275, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:21 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in URL should be rejected", "scored": true, "durationMs": 50.4628, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:21 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Control characters in header value should be rejected", "scored": true, "durationMs": 50.5616, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:21 GMT\r\nContent-Length: 90\r\nConnection: close\r\n\r\n

Bad Request (Specified value has invalid Control characters. (Parameter 'value'))

", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 4999.8568, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.4764, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 50.8204, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 100KB method name should be rejected", "scored": true, "durationMs": 53.6198, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.4591, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 105\r\nConnection: close\r\n\r\n

Bad Request (Specified value 'X-T????st' has invalid HTTP Header characters. (Parameter 'name'))

", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.6024, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 50.4893, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 76\r\nConnection: close\r\n\r\n

Bad Request (Value was either too large or too small for an Int64.)

", "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 50.5236, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in header value should be rejected", "scored": true, "durationMs": 50.3718, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 90\r\nConnection: close\r\n\r\n

Bad Request (Specified value has invalid Control characters. (Parameter 'value'))

", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 50.5764, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2f\r\n

Bad Request (Cannot parse chunk size.)

\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 505, "expected": "400/505/close/timeout", "got": "505", "connectionState": "Open", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 50.5224, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": "HTTP/1.1 505 Http Version Not Supported\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 64\r\n\r\n

Http Version Not Supported (Http Version Not Supported)

", "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.5213, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 71\r\nConnection: close\r\n\r\n

Bad Request (The input string '' was not in a correct format.)

", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.7574, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 50.8522, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 50.6845, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 51.0683, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 49.5657, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 51.5051, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.1 400 Bad Request\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2b\r\n

Bad Request (chunk size too long.)

\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 51.3004, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Sisk/1.6\r\nContent-Type: text/plain; charset=utf-8\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:31 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5001.0079, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "Sisk", "language": "C#"}, {"summary": {"total": 143, "scored": 125, "passed": 72, "failed": 47, "warnings": 6, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 62.4722, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "ClosedByServer", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.4321, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "ClosedByServer", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.6734, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 50.438, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400, got 200 \u2014 Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 51.0559, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 50.7878, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.532, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 40\r\nConnection: close\r\n\r\n

Bad Request (Invalid host name)

", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 505, "expected": "400/505 or close", "got": "505", "connectionState": "Open", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.6595, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 505 Http Version Not Supported\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 64\r\n\r\n

Http Version Not Supported (Http Version Not Supported)

", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.6008, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.6136, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.6843, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 52\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (parts).)

", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 51.0658, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:40 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 50.6345, "rawRequest": "GET /\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 52\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (parts).)

", "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.7229, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 104\r\nConnection: close\r\n\r\n

Bad Request (Specified value 'Bad[Name' has invalid HTTP Header characters. (Parameter 'name'))

", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 50.5229, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.7704, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 51.071, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (The input string 'abc' was not in a correct format.)

", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with plus sign must be rejected", "scored": true, "durationMs": 51.9757, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 50.5522, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.9081, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.7459, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 50.778, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.6973, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 58\r\nConnection: close\r\n\r\n

Bad Request (Invalid url: http://localhost:8080*)

", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 400, "expected": "2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Expected 2xx, got 400 \u2014 OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 50.7106, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 58\r\nConnection: close\r\n\r\n

Bad Request (Invalid url: http://localhost:8080*)

", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 501, "expected": "400/501 or close", "got": "501", "connectionState": "Open", "reason": "Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 50.8556, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 51.09, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 50.9935, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Warn", "statusCode": 200, "expected": "400/405/501 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.9143, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 2\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 49.9016, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "ClosedByServer", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 49.8863, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Expose-Headers: \r\nAccept: */*\r\nAccept-Language: en-US, en\r\nAccept-Charset: ISO-8859-1, utf-8\r\nCache-Control: no-cache\r\nConnection: close\r\nHost: diogo-system-product-name:8080\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Fail", "statusCode": 411, "expected": "2xx or close", "got": "411", "connectionState": "ClosedByServer", "reason": "Expected 2xx or close, got 411 \u2014 POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.839, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 411 Length Required\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:10:41 GMT\r\nContent-Length: 24\r\nConnection: close\r\n\r\n

Length Required

", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5000.9497, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx, got TimedOut \u2014 Valid single-chunk POST must be accepted", "scored": true, "durationMs": 5000.5871, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx, got TimedOut \u2014 Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 5000.2458, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "2xx or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 5001.196, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5001.0558, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 411, "expected": "!101", "got": "411", "connectionState": "ClosedByServer", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 50.8215, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 411 Length Required\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:11:06 GMT\r\nContent-Length: 24\r\nConnection: close\r\n\r\n

Length Required

", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Fail", "statusCode": null, "expected": "!101", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected !101, got TimedOut \u2014 Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 5001.1303, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Fail", "statusCode": null, "expected": "!101", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected !101, got TimedOut \u2014 Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 5000.4173, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Pass", "statusCode": 400, "expected": "400/405/501 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "CONNECT to an origin server must be rejected", "scored": true, "durationMs": 50.9251, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:11:17 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (Invalid url: http://example.com:8080example.com:443)

", "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Fail", "statusCode": null, "expected": "417 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 417 or 2xx, got TimedOut \u2014 Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 5000.7811, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 5000.4996, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": null, "expected": "2xx or 400", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx or 400, got TimedOut \u2014 Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 5000.735, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Fail", "statusCode": null, "expected": "426 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 426 or 2xx, got TimedOut \u2014 WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 5000.5493, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Fail", "statusCode": null, "expected": "405/501 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 405/501 or 2xx, got TimedOut \u2014 TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 5001.4962, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Host header value must be rejected", "scored": true, "durationMs": 50.7924, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:11:42 GMT\r\nContent-Length: 40\r\nConnection: close\r\n\r\n

Bad Request (Invalid host name)

", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.85, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:11:42 GMT\r\nContent-Length: 52\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (parts).)

", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.7097, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:11:42 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.687, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:11:42 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.4743, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:11:42 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Fail", "statusCode": null, "expected": "2xx + close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx + close, got TimedOut \u2014 Server must close connection after responding to Connection: close", "scored": true, "durationMs": 5000.8464, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Fail", "statusCode": null, "expected": "2xx + close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx + close, got TimedOut \u2014 HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 5000.7992, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": null, "expected": "200 or 400", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 200 or 400, got TimedOut \u2014 HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 5000.5845, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": null, "expected": "200 or 505", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 200 or 505, got TimedOut \u2014 HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 5001.2249, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Fail", "statusCode": null, "expected": "400/405 or 200", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400/405 or 200, got TimedOut \u2014 TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 5000.6362, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Fail", "statusCode": null, "expected": "2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx, got TimedOut \u2014 Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 5000.2995, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx, got TimedOut \u2014 Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 5000.5502, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 5001.024, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 51.2144, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:12:22 GMT\r\nContent-Length: 46\r\nConnection: close\r\n\r\n

Bad Request (Invalid Content-Length.)

", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 5000.6635, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "Open", "reason": "Expected 400 or close, got 501 \u2014 Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.6881, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:12:27 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 5000.8747, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 5000.5322, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.5764, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:12:37 GMT\r\nContent-Length: 46\r\nConnection: close\r\n\r\n

Bad Request (Invalid Content-Length.)

", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or close, got TimedOut \u2014 CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 5001.3467, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or close, got TimedOut \u2014 TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 5000.6815, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 5001.1962, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.8155, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:12:52 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

HTTP/1.1 404 Not Found\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:12:52 GMT\r\nContent-Length: 30\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Not Found (Not Found)

", "behavioralNote": null}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 5000.2496, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 5000.7097, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.696, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:13:02 GMT\r\nContent-Length: 76\r\nConnection: close\r\n\r\n

Bad Request (The input string '5, 10' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "Open", "reason": "Expected 400 or close, got 501 \u2014 Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.3862, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:13:02 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 5000.3743, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 5000.7535, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 5000.5138, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 50.8968, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:13:17 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (The input string '0o5' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 5001.4599, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 501 \u2014 Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.706, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:13:22 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

HTTP/1.1 404 Not Found\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:13:22 GMT\r\nContent-Length: 30\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Not Found (Not Found)

", "behavioralNote": null}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 50.8293, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:13:22 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 501 \u2014 Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.4682, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:13:22 GMT\r\nContent-Length: 42\r\n\r\n

Not Implemented (Not Implemented)

HTTP/1.1 200 OK\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:13:22 GMT\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 5000.5998, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.6014, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:13:27 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (The input string '0x5' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.3408, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:13:27 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (The input string '1 0' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk size with leading space must be rejected", "scored": true, "durationMs": 5000.1543, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 5000.1132, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 5000.2466, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 5000.3329, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 5000.239, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 5000.1441, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 5000.6841, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 5000.5707, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 5000.4606, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.6991, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:14:12 GMT\r\nContent-Length: 90\r\nConnection: close\r\n\r\n

Bad Request (Specified value has invalid Control characters. (Parameter 'value'))

", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 5000.3574, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "Open", "reason": "Expected 400 or close, got 501 \u2014 Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.5382, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:14:18 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Negative chunk size must be rejected", "scored": true, "durationMs": 5000.212, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 5000.2438, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.4451, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:14:28 GMT\r\nContent-Length: 75\r\nConnection: close\r\n\r\n

Bad Request (The input string '5, 5' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.4734, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:14:28 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Fail", "statusCode": 100, "expected": "400 or 2xx", "got": "100", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 100 \u2014 Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.4413, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 100 Continue\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 5000.8345, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 5000.3279, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 5000.5226, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 5000.4892, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 5000.4802, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 5000.4273, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.4404, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:14:58 GMT\r\nContent-Length: 74\r\nConnection: close\r\n\r\n

Bad Request (The input string '1_0' was not in a correct format.)

", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 5000.4135, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 5000.5927, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 5001.5829, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 51.1831, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:15:13 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.658, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Not Implemented\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:15:13 GMT\r\nContent-Length: 24\r\n\r\n

Not Implemented

", "behavioralNote": null}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 5000.6416, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 5000.456, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Host header with comma-separated values must be rejected", "scored": true, "durationMs": 5000.4887, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 5000.205, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 5000.528, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 51.0283, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:15:38 GMT\r\nContent-Length: 52\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (parts).)

", "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": null, "expected": "400/414/431 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400/414/431 or close, got TimedOut \u2014 100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 5001.2794, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 51.027, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:15:43 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 51.6348, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:15:43 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "NUL byte in URL should be rejected", "scored": true, "durationMs": 5000.614, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Control characters in header value should be rejected", "scored": true, "durationMs": 50.4787, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:15:48 GMT\r\nContent-Length: 90\r\nConnection: close\r\n\r\n

Bad Request (Specified value has invalid Control characters. (Parameter 'value'))

", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5000.7961, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 4999.6169, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 50.8427, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:15:58 GMT\r\nContent-Length: 34\r\nConnection: close\r\n\r\n

Bad Request (Bad Request)

", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or close, got TimedOut \u2014 100KB method name should be rejected", "scored": true, "durationMs": 5001.4795, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.721, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:16:03 GMT\r\nContent-Length: 105\r\nConnection: close\r\n\r\n

Bad Request (Specified value 'X-T????st' has invalid HTTP Header characters. (Parameter 'name'))

", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 5000.4641, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 51.5922, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:16:08 GMT\r\nContent-Length: 76\r\nConnection: close\r\n\r\n

Bad Request (Value was either too large or too small for an Int64.)

", "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 50.8616, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:16:08 GMT\r\nContent-Length: 54\r\nConnection: close\r\nKeep-Alive: true\r\n\r\n

Bad Request (Invalid request line (version).)

", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in header value should be rejected", "scored": true, "durationMs": 50.7507, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:16:08 GMT\r\nContent-Length: 90\r\nConnection: close\r\n\r\n

Bad Request (Specified value has invalid Control characters. (Parameter 'value'))

", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 5000.4531, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 505, "expected": "400/505/close/timeout", "got": "505", "connectionState": "Open", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 50.6962, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": "HTTP/1.1 505 Http Version Not Supported\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:16:13 GMT\r\nContent-Length: 64\r\n\r\n

Http Version Not Supported (Http Version Not Supported)

", "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.3291, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/html\r\nServer: Microsoft-NetCore/2.0\r\nDate: Thu, 12 Feb 2026 21:16:13 GMT\r\nContent-Length: 71\r\nConnection: close\r\n\r\n

Bad Request (The input string '' was not in a correct format.)

", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 5000.4282, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx/404", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx/404, got TimedOut \u2014 Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 5000.5795, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 5000.5436, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx/404", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx/404, got TimedOut \u2014 Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 5000.4861, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx/404", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx/404, got TimedOut \u2014 Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 5000.7692, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 5001.5843, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": null, "expected": "200/206/400/416", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 200/206/400/416, got TimedOut \u2014 1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 5000.5681, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5000.6982, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "Watson", "language": "C#"}, {"summary": {"total": 143, "scored": 125, "passed": 112, "failed": 4, "warnings": 9, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 64.1536, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close (pass), 2xx (warn)", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 52.4886, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close (pass), 2xx (warn)", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.7329, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 50.4747, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.5019, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 50.7475, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.6011, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/505 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.9628, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.7536, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.4728, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.4665, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 50.481, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 5002.0627, "rawRequest": "GET /\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.777, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 50.8102, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 51.2952, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 50.9495, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with plus sign must be rejected", "scored": true, "durationMs": 50.8053, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 51.1739, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 51.0106, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 51.0824, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Host header with path component must be rejected", "scored": true, "durationMs": 50.9351, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 51.1257, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 50.6799, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 50\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: OPTIONS\r\nPath: *\r\n", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400/501 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 51.1447, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 50.8412, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 49.9191, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 67\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: http://localhost:8080/\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Warn", "statusCode": 200, "expected": "400/405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.6323, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: get\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 50.9646, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.7535, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 47\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: POST\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.5553, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 47\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: POST\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5000.9572, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 51.9869, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 50.6962, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 11\r\nConnection: keep-alive\r\n\r\nhello world", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 50.4689, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 47\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: POST\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5000.5005, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 50.9831, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 47\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: POST\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 50.6176, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.5587, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Pass", "statusCode": 400, "expected": "400/405/501 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "CONNECT to an origin server must be rejected", "scored": true, "durationMs": 50.3654, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "417 or 2xx", "got": "200", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.4333, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.533, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or 400", "got": "200", "connectionState": "Open", "reason": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 50.4751, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.5151, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 50.4066, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 48\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: TRACE\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 50.3499, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.541, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.5026, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.5292, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.501, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Fail", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "Open", "reason": "Expected 2xx + close, got 200 \u2014 Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.565, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Warn", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "Open", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 50.4862, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "200 or 400", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 50.5342, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 400, "expected": "200 or 505", "got": "400", "connectionState": "ClosedByServer", "reason": "Expected 200 or 505, got 400 \u2014 HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 50.7081, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "400/405 or 200", "got": "200", "connectionState": "Open", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.5638, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 48\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: TRACE\r\nPath: /\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 49.3848, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.5384, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 10\r\nConnection: keep-alive\r\n\r\nhelloworld", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 50.8144, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 49.6558, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.9471, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.783, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 50.5162, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.9989, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.8507, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.5979, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 0.4491, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.4316, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.418, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.4211, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 50.6137, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.5536, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.3415, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 50.3249, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 50.4974, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.5784, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 49.4626, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.4838, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.4658, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 50.6179, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.4478, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.6664, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.4959, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.4542, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with leading space must be rejected", "scored": true, "durationMs": 50.5819, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.6117, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.5458, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.3306, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.5127, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 50.5018, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 50.6975, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.8717, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.4149, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.5559, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.7566, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.6059, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative chunk size must be rejected", "scored": true, "durationMs": 50.7459, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.8341, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.8491, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.7338, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.6422, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.5962, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.4943, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.511, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.5386, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.5363, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 47\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: HEAD\r\nPath: /\r\n", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 50.5884, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 50\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: OPTIONS\r\nPath: /\r\n", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.3715, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.4233, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.653, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 50.5752, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 50.5395, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.5349, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 50.5968, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 50.7231, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 70\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: http://other.example.com/\r\n", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.4568, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.5515, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.5077, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 5000.4971, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/414/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 52.6188, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nContent-Type: text/plain\r\nContent-Length: 37\r\nConnection: keep-alive\r\n\r\n431 Request Header Fields Too Large\r\n", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 50.8309, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nContent-Type: text/plain\r\nContent-Length: 37\r\nConnection: keep-alive\r\n\r\n431 Request Header Fields Too Large\r\n", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 61.0772, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nContent-Type: text/plain\r\nContent-Length: 37\r\nConnection: keep-alive\r\n\r\n431 Request Header Fields Too Large\r\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in URL should be rejected", "scored": true, "durationMs": 50.4006, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Control characters in header value should be rejected", "scored": true, "durationMs": 50.4138, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5000.6895, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.3526, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 51.3942, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nContent-Type: text/plain\r\nContent-Length: 37\r\nConnection: keep-alive\r\n\r\n431 Request Header Fields Too Large\r\n", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB method name should be rejected", "scored": true, "durationMs": 51.2742, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.4057, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.5138, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 50.5086, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 50.6341, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in header value should be rejected", "scored": true, "durationMs": 50.4248, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 50.5211, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/505/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 50.6572, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.4577, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.8263, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 5\r\nConnection: keep-alive\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx/404", "got": "400", "connectionState": "ClosedByServer", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 50.5492, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 50.5769, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx/404", "got": "400", "connectionState": "ClosedByServer", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 50.6839, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain\r\nContent-Length: 17\r\nConnection: keep-alive\r\n\r\n400 Bad Request\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 50.7737, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 74\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /path%0d%0aX-Injected:%20true\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 5000.9566, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 51.8433, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 46\r\nConnection: keep-alive\r\n\r\nHello from GlyphServer\r\nMethod: GET\r\nPath: /\r\n", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5000.7516, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "Glyph", "language": "C#"}, {"summary": {"total": 143, "scored": 125, "passed": 75, "failed": 39, "warnings": 11, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 62.8133, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close (pass), 2xx (warn)", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.5176, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close (pass), 2xx (warn)", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.5514, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 49.5731, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.7634, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 50.6961, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.5479, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/505 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.4936, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 26\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nHTTP Version Not Supported", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.4252, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.4346, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.4728, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 404, "expected": "400 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 404 \u2014 Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 50.8778, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 5001.1041, "rawRequest": "GET /\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.3397, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 50.4472, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.473, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 50.6565, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with plus sign must be rejected", "scored": true, "durationMs": 50.497, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 50.4891, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.4846, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.4164, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 50.5474, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.5147, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 400, "expected": "2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Expected 2xx, got 400 \u2014 OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 50.4662, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400/501 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/501 or close, got 200 \u2014 Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 50.8815, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"\"", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 50.5792, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 50.5991, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Fail", "statusCode": 404, "expected": "400/405/501 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 400/405/501 or 2xx, got 404 \u2014 Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.7745, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 49.8704, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.534, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"\"", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.5612, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"\"", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5000.0539, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx, got TimedOut \u2014 Valid single-chunk POST must be accepted", "scored": true, "durationMs": 5000.4685, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx, got TimedOut \u2014 Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 5000.8152, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "2xx or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 5000.4628, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5000.7505, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 49.7838, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"\"", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 50.8762, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.4694, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Pass", "statusCode": 400, "expected": "400/405/501 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "CONNECT to an origin server must be rejected", "scored": true, "durationMs": 50.4791, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "417 or 2xx", "got": "200", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.6982, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.7519, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": null, "expected": "2xx or 400", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx or 400, got TimedOut \u2014 Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 5000.743, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.8045, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Fail", "statusCode": 404, "expected": "405/501 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 405/501 or 2xx, got 404 \u2014 TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 51.9391, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 50.8946, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.7707, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.8339, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 26\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nHTTP Version Not Supported", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.7473, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 26\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nHTTP Version Not Supported", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.5882, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 26\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nHTTP Version Not Supported", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.586, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: close\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 50.6636, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: close\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 50.5638, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: close\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 400, "expected": "200 or 505", "got": "400", "connectionState": "ClosedByServer", "reason": "Expected 200 or 505, got 400 \u2014 HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 50.704, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 26\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nHTTP Version Not Supported", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Fail", "statusCode": 404, "expected": "400/405 or 200", "got": "404", "connectionState": "Open", "reason": "Expected 400/405 or 200, got 404 \u2014 TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 51.7265, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 50.4011, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 2xx, got TimedOut \u2014 Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 5000.6571, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 5001.3465, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 50.8504, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.8372, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 5000.8539, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 5000.5894, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.7873, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.6048, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or close, got TimedOut \u2014 CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 4999.5808, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or close, got TimedOut \u2014 TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 5000.7047, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 51.1134, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 5000.5905, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.8056, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 5000.5414, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.3412, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 5000.4343, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 5000.4789, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 5001.2706, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.6385, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 50.8375, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.5163, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.6487, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": "Body: \"hello\""}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 5000.7187, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 5000.2481, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.703, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.4826, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.4152, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk size with leading space must be rejected", "scored": true, "durationMs": 5000.3738, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.4431, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 500 Internal Server Error\r\nContent-Length: 21\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInternal Server Error", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 4999.7736, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.8345, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 Internal Server Error\r\nContent-Length: 21\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInternal Server Error", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.5986, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 Internal Server Error\r\nContent-Length: 21\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInternal Server Error", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 5000.2352, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 5000.4682, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 5000.4096, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 5000.4962, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 5000.5818, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 5000.5806, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.8429, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": "Body: \"hello\""}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative chunk size must be rejected", "scored": true, "durationMs": 50.6868, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.6299, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": "Body: \"hello\""}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.4452, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 5000.5383, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.5004, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.6207, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.4815, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.6271, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.5334, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Fail", "statusCode": 404, "expected": "400 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 404 \u2014 HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 51.5928, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Fail", "statusCode": 404, "expected": "400 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 404 \u2014 OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 51.4409, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.4351, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.614, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 51.077, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"\"", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 51.3181, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 202\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 50.412, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 5000.7837, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 5000.7768, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 50.7373, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.5219, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.6452, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.6824, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 50.6282, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 413, "expected": "400/414/431 or close", "got": "413", "connectionState": "ClosedByServer", "reason": "Expected 400/414/431 or close, got 413 \u2014 100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 51.3174, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 413 Payload Too Large\r\nContent-Length: 17\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nPayload Too Large", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 413, "expected": "400/431 or close", "got": "413", "connectionState": "ClosedByServer", "reason": "Expected 400/431 or close, got 413 \u2014 100KB header value should be rejected with 431", "scored": true, "durationMs": 50.9704, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 413 Payload Too Large\r\nContent-Length: 17\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nPayload Too Large", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 413, "expected": "400/431 or close", "got": "413", "connectionState": "ClosedByServer", "reason": "Expected 400/431 or close, got 413 \u2014 10,000 headers should be rejected with 431", "scored": true, "durationMs": 51.5718, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 413 Payload Too Large\r\nContent-Length: 17\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nPayload Too Large", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 404, "expected": "400 or close", "got": "404", "connectionState": "Open", "reason": "Expected 400 or close, got 404 \u2014 NUL byte in URL should be rejected", "scored": true, "durationMs": 51.5093, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Control characters in header value should be rejected", "scored": true, "durationMs": 50.3983, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5000.5762, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.4175, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 413, "expected": "400/431 or close", "got": "413", "connectionState": "ClosedByServer", "reason": "Expected 400/431 or close, got 413 \u2014 100KB header name should be rejected with 400/431", "scored": true, "durationMs": 51.1875, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 413 Payload Too Large\r\nContent-Length: 17\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nPayload Too Large", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 413, "expected": "400 or close", "got": "413", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 413 \u2014 100KB method name should be rejected", "scored": true, "durationMs": 51.8841, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 413 Payload Too Large\r\nContent-Length: 17\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nPayload Too Large", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.6163, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 404, "expected": "400 or close", "got": "404", "connectionState": "Open", "reason": "Expected 400 or close, got 404 \u2014 Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 52.1939, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 50.4251, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 50.6313, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in header value should be rejected", "scored": true, "durationMs": 50.3623, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 51.228, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 Internal Server Error\r\nContent-Length: 21\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInternal Server Error", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/505/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 50.5707, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.4358, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nContent-Length: 11\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nBad Request", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.4959, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 7\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"hello\"", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 51.4402, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 404, "expected": "400 or close", "got": "404", "connectionState": "Open", "reason": "Expected 400 or close, got 404 \u2014 Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 51.3093, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 51.4646, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 51.418, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nContent-Length: 9\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: keep-alive\r\n\r\nNot Found", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 5001.5014, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 51.2636, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Length: 4\r\nContent-Type: application/json; charset=utf-8\r\nConnection: keep-alive\r\n\r\n\"OK\"", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 413, "expected": "400/close/timeout", "got": "413", "connectionState": "ClosedByServer", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 50.4371, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": "HTTP/1.1 413 Payload Too Large\r\nContent-Length: 17\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nPayload Too Large", "behavioralNote": null}], "name": "SimpleW", "language": "C#"}, {"summary": {"total": 143, "scored": 125, "passed": 47, "failed": 59, "warnings": 19, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 66.2604, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close (pass), 2xx (warn)", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.7703, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nConnection: Close\r\nContent-Length: 54\r\n\r\nHTTP protocol version expected (got: 'HTTP/1.1\nHost:')", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.5597, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400, got 200 \u2014 Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 51.7091, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOKHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.6933, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 51.0538, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.5462, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nConnection: Close\r\nContent-Length: 51\r\n\r\nMandatory 'Host' header is missing from the request", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/505 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.6558, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nConnection: Close\r\nContent-Length: 33\r\n\r\nUnexpected protocol version '9.9'", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.7642, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.4536, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nConnection: Close\r\nContent-Length: 51\r\n\r\nMandatory 'Host' header is missing from the request", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.5232, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 404, "expected": "400 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 404 \u2014 Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 60.7928, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:46 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nETag: \"18446744071584333603\"\r\n\r\n4F\r\n{\"status\":404,\"message\":\"The requested resource does not exist on this server\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 50.5491, "rawRequest": "GET /\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.5167, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Header line without colon must be rejected", "scored": true, "durationMs": 50.5865, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOKHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.5164, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 50.4892, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nConnection: Close\r\nContent-Length: 55\r\n\r\nContent-Length header is expected to be a numeric value", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with plus sign must be rejected", "scored": true, "durationMs": 51.6871, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 50.6326, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nConnection: Close\r\nContent-Length: 51\r\n\r\nMandatory 'Host' header is missing from the request", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.6653, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.4756, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 50.4789, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.3781, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 405, "expected": "2xx", "got": "405", "connectionState": "Open", "reason": "Expected 2xx, got 405 \u2014 OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 51.0982, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\n\r\n48\r\n{\"status\":405,\"message\":\"There is no method of a matching request type\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400/501 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/501 or close, got 200 \u2014 Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 50.7198, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 50.6956, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Fail", "statusCode": 404, "expected": "400 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 404 \u2014 Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 50.7514, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nETag: \"18446744071584333603\"\r\n\r\n4F\r\n{\"status\":404,\"message\":\"The requested resource does not exist on this server\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Warn", "statusCode": 200, "expected": "400/405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.6361, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 50.4244, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.5143, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.4565, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:47 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5000.8595, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 57.2396, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:53 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 52.5418, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:53 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 11\r\n\r\nhello world", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 52.2898, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:53 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5000.83, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "ClosedByServer", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 50.7663, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 50.7136, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "ClosedByServer", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.6393, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Fail", "statusCode": 404, "expected": "400/405/501 or close", "got": "404", "connectionState": "Open", "reason": "Expected 400/405/501 or close, got 404 \u2014 CONNECT to an origin server must be rejected", "scored": true, "durationMs": 50.6147, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\n\r\n4F\r\n{\"status\":404,\"message\":\"The requested resource does not exist on this server\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "417 or 2xx", "got": "200", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.6065, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.5171, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 500, "expected": "2xx or 400", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 2xx or 400, got 500 \u2014 Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 51.588, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Length: 59\r\n\r\nThe input string '5;ext=value' was not in a correct format.", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.6835, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Pass", "statusCode": 405, "expected": "405/501 or 2xx", "got": "405", "connectionState": "Open", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 50.7191, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\n\r\n48\r\n{\"status\":405,\"message\":\"There is no method of a matching request type\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 50.4585, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.8047, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.5112, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Length: 46\r\n\r\nHTTP protocol version expected (got: 'HTTP/1')", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.4363, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Length: 50\r\n\r\nHTTP protocol version expected (got: 'HTTP/01.01')", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.518, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Length: 45\r\n\r\nHTTP protocol version expected (got: 'HTTP/')", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.7123, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 50.6471, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "200 or 400", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 50.482, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:58 GMT\r\nConnection: Close\r\nContent-Length: 51\r\n\r\nMandatory 'Host' header is missing from the request", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 400, "expected": "200 or 505", "got": "400", "connectionState": "ClosedByServer", "reason": "Expected 200 or 505, got 400 \u2014 HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 49.6991, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:59 GMT\r\nConnection: Close\r\nContent-Length: 33\r\n\r\nUnexpected protocol version '1.2'", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Pass", "statusCode": 405, "expected": "400/405 or 200", "got": "405", "connectionState": "Open", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.5504, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:59 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\n\r\n48\r\n{\"status\":405,\"message\":\"There is no method of a matching request type\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 50.6543, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:59 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhelloHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:59 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.6917, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:20:59 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 10\r\n\r\nhelloworld", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 5000.8313, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 50.8999, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:04 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 10\r\n\r\nhelloworld", "behavioralNote": "Used second CL (10 bytes)"}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.5409, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:04 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.735, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:04 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 50.4658, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:04 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.4284, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:04 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Negative Content-Length must be rejected", "scored": true, "durationMs": 50.5226, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:04 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.5688, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:04 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 4\r\n\r\n0\r\n\rHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:04 GMT\r\nConnection: Close\r\nContent-Length: 43\r\n\r\nUnable to read HTTP verb from request line.", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or close, got TimedOut \u2014 TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 5000.5441, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.571, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.5363, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.629, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 50.6372, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.5827, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nConnection: Close\r\nContent-Length: 55\r\n\r\nContent-Length header is expected to be a numeric value", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.6892, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\nHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 50.4438, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.0 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nConnection: Close\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 51.1015, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nConnection: Close\r\nContent-Length: 50\r\n\r\nThe input string '5;' was not in a correct format.", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.5681, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\ne\r\n\r\nHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nConnection: Close\r\nContent-Length: 43\r\n\r\nUnable to read HTTP verb from request line.", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 49.484, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:09 GMT\r\nConnection: Close\r\nContent-Length: 55\r\n\r\nContent-Length header is expected to be a numeric value", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.5992, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 51\r\n\r\nThe input string '1_0' was not in a correct format.", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.5157, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 50.9025, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.4986, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.8361, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\nHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.5151, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 55\r\n\r\nContent-Length header is expected to be a numeric value", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.533, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 55\r\n\r\nContent-Length header is expected to be a numeric value", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with leading space must be rejected", "scored": true, "durationMs": 50.7602, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.7, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 48\r\n\r\nThe input string '' was not in a correct format.", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.8937, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 56\r\n\r\nThe input string '5;\nhello' was not in a correct format.", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.5938, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 48\r\n\r\nThe input string '' was not in a correct format.", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.7731, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 48\r\n\r\nThe input string '' was not in a correct format.", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 50.5165, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 54\r\n\r\nThe input string '5;\u0000ext' was not in a correct format.", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 50.6521, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 51\r\n\r\nThe input string '5;a' was not in a correct format.", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 51.5725, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.67, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.5211, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.8017, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nConnection: Close\r\nContent-Length: 76\r\n\r\nSpecified argument was out of the range of valid values. (Parameter 'start')", "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.3537, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:10 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Negative chunk size must be rejected", "scored": true, "durationMs": 50.4585, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nConnection: Close\r\nContent-Length: 50\r\n\r\nThe input string '-1' was not in a correct format.", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.4807, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.4551, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nConnection: Close\r\nContent-Length: 55\r\n\r\nContent-Length header is expected to be a numeric value", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.5067, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.5884, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.7916, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhelloHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.7363, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhelloHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.6439, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhelloHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.7511, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhelloHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nConnection: Close\r\nContent-Length: 44\r\n\r\nHTTP protocol version expected (got: 'evil')", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.4799, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Fail", "statusCode": 405, "expected": "400 or 2xx", "got": "405", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 405 \u2014 OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 50.6573, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 405 Method Not Allowed\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\n\r\n48\r\n{\"status\":405,\"message\":\"There is no method of a matching request type\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.4615, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nConnection: Close\r\nContent-Length: 55\r\n\r\nContent-Length header is expected to be a numeric value", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.471, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.7718, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 50.5014, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 49.2783, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.5091, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 50.428, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Fail", "statusCode": 404, "expected": "400 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 404 \u2014 Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 50.6142, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nETag: \"18446744071584333603\"\r\n\r\n4F\r\n{\"status\":404,\"message\":\"The requested resource does not exist on this server\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.4935, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:11 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.6737, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:12 GMT\r\nConnection: Close\r\nContent-Length: 48\r\n\r\nThe input string '' was not in a correct format.", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.7068, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:12 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhelloHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:12 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 50.6494, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:12 GMT\r\nConnection: Close\r\nContent-Length: 44\r\n\r\nHTTP protocol version expected (got: 'K???')", "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/414/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 50.9511, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:12 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 50.88, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:12 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token 'None' (expected 'Word')", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 500, "expected": "400/431 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400/431 or close, got 500 \u2014 10,000 headers should be rejected with 431", "scored": true, "durationMs": 52.1064, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:12 GMT\r\nConnection: Close\r\nContent-Length: 76\r\n\r\nSpecified argument was out of the range of valid values. (Parameter 'start')", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 404, "expected": "400 or close", "got": "404", "connectionState": "Open", "reason": "Expected 400 or close, got 404 \u2014 NUL byte in URL should be rejected", "scored": true, "durationMs": 50.4389, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:12 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nETag: \"18446744071584333603\"\r\n\r\n4F\r\n{\"status\":404,\"message\":\"The requested resource does not exist on this server\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Control characters in header value should be rejected", "scored": true, "durationMs": 50.3938, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:12 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 50.4967, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:12 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token 'None' (expected 'Word')", "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.5901, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/431 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400/431 or close, got 200 \u2014 100KB header name should be rejected with 400/431", "scored": true, "durationMs": 51.0465, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOKHTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nConnection: Close\r\nContent-Length: 43\r\n\r\nUnable to read HTTP verb from request line.", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB method name should be rejected", "scored": true, "durationMs": 50.8501, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nConnection: Close\r\nContent-Length: 43\r\n\r\nUnable to read HTTP verb from request line.", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.5093, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 404, "expected": "400 or close", "got": "404", "connectionState": "Open", "reason": "Expected 400 or close, got 404 \u2014 Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.6117, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nETag: \"18446744071584333603\"\r\n\r\n4F\r\n{\"status\":404,\"message\":\"The requested resource does not exist on this server\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 50.4384, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nConnection: Close\r\nContent-Length: 55\r\n\r\nContent-Length header is expected to be a numeric value", "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 50.5321, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nConnection: Close\r\nContent-Length: 41\r\n\r\nUnexpected token while parsing path: None", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in header value should be rejected", "scored": true, "durationMs": 50.3839, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 51.0058, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.0 500 Internal Server Error\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nConnection: Close\r\nContent-Length: 53\r\n\r\nValue was either too large or too small for an Int64.", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/505/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 50.5406, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nConnection: Close\r\nContent-Length: 33\r\n\r\nUnexpected protocol version '2.0'", "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.4564, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nConnection: Close\r\nContent-Length: 55\r\n\r\nContent-Length header is expected to be a numeric value", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.5792, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:17 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 5\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 50.4555, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:18 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nETag: \"18446744071584333603\"\r\n\r\n4F\r\n{\"status\":404,\"message\":\"The requested resource does not exist on this server\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 404, "expected": "400 or close", "got": "404", "connectionState": "Open", "reason": "Expected 400 or close, got 404 \u2014 Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 50.5266, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:18 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nETag: \"18446744071584333603\"\r\n\r\n4F\r\n{\"status\":404,\"message\":\"The requested resource does not exist on this server\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 50.5749, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:18 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nETag: \"18446744071584333603\"\r\n\r\n4F\r\n{\"status\":404,\"message\":\"The requested resource does not exist on this server\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 50.5162, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:18 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nETag: \"18446744071584333603\"\r\n\r\n4F\r\n{\"status\":404,\"message\":\"The requested resource does not exist on this server\"}\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 51.7402, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.0 400 Bad Request\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:18 GMT\r\nConnection: Close\r\nContent-Length: 19\r\n\r\nChunk size expected", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 51.9884, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: GenHTTP/10.4.2.0\r\nDate: Thu, 12 Feb 2026 21:21:18 GMT\r\nContent-Type: text/plain; charset=UTF-8\r\nContent-Length: 2\r\nETag: \"1979081074\"\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5000.7971, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "GenHTTP", "language": "C#"}, {"summary": {"total": 143, "scored": 125, "passed": 93, "failed": 16, "warnings": 16, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 64.6484, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:26 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.8297, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:26 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close (pass), 2xx (warn)", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.0005, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 50.6841, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:26 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.6348, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:26 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 50.7369, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:26 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.5551, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:26 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/505 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.6366, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.5245, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:27 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.453, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.5609, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 50.7386, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:27 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 5001.6214, "rawRequest": "GET /\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.8197, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 50.5, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.5977, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:32 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 50.5943, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with plus sign must be rejected", "scored": true, "durationMs": 50.546, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 50.592, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.8565, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:32 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.5896, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:32 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 50.6118, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:32 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.501, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:32 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 50.4324, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:32 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400/501 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 50.6672, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 50.6934, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:32 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 50.6295, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:32 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Pass", "statusCode": 400, "expected": "400/405/501 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.6157, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 50.9981, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:33 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.7705, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:33 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.572, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:33 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5000.6292, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 50.6623, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:38 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 50.7012, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:38 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\nb\r\nhello world\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 50.5963, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:38 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5000.7364, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 50.9231, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 50.7796, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.678, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Pass", "statusCode": null, "expected": "400/405/501 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "CONNECT to an origin server must be rejected", "scored": true, "durationMs": 0.7167, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Pass", "statusCode": 417, "expected": "417 or 2xx", "got": "417", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.6444, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 417 Expectation Failed\r\nDate: Thu, 12 Feb 2026 21:21:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.7066, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or 400", "got": "200", "connectionState": "Open", "reason": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 50.6394, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.7276, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 50.5623, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 50.4932, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.5577, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.4082, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.63, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.4301, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.7356, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:44 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 51.2459, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:44 GMT\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 50.7033, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:44 GMT\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 400, "expected": "200 or 505", "got": "400", "connectionState": "ClosedByServer", "reason": "Expected 200 or 505, got 400 \u2014 HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 50.5458, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "400/405 or 200", "got": "200", "connectionState": "Open", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.7148, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:44 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 51.0362, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:44 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.7144, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:44 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\na\r\nhelloworld\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 50.873, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 50.9324, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.9295, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:44 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.6252, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 50.5194, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.6993, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.6332, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.6537, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 0.5155, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.4891, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:44 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.6381, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.9601, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:44 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 50.6626, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.4656, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.4504, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 50.4561, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 50.7708, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:45 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.5966, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 50.5203, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.6234, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.6327, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:45 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": "Body: 5\r\nhello\r\n0"}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 50.4681, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.4368, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.5234, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.4144, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.3506, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with leading space must be rejected", "scored": true, "durationMs": 50.4362, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.5271, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.602, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.4697, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.6501, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 50.4874, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 50.5505, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.3761, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.46, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.5705, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.7627, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:46 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.4691, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative chunk size must be rejected", "scored": true, "durationMs": 50.559, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.694, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:46 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": "Body: 5\r\nhello\r\n0"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.588, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.5987, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Fail", "statusCode": 100, "expected": "400 or 2xx", "got": "100", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 100 \u2014 Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.8377, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 100 Continue\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.7368, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:46 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.5185, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.6865, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:46 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.6587, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:46 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.6829, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:46 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 50.6338, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:46 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.5511, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.6602, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.915, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:46 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 50.7828, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:46 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\nc8\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 50.572, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.6026, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 50.6711, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 50.7558, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:47 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.537, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:47 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.6954, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.8122, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:47 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 50.8293, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/414/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 52.7912, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 51.2137, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 51.6279, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in URL should be rejected", "scored": true, "durationMs": 50.3974, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Control characters in header value should be rejected", "scored": true, "durationMs": 50.4214, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5000.5739, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.3686, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 51.3496, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB method name should be rejected", "scored": true, "durationMs": 50.9727, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.5403, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.7459, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:57 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 50.5161, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 50.7649, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in header value should be rejected", "scored": true, "durationMs": 50.6501, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 50.5715, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/505/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 50.671, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.6155, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.8027, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:58 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 50.6406, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:58 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 50.5769, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:58 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 50.5369, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:58 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 50.6145, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:58 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 413, "expected": "400 or 2xx", "got": "413", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 413 \u2014 64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 51.4966, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.1 413 Payload Too Large\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 50.3643, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nDate: Thu, 12 Feb 2026 21:21:58 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5000.9877, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "Node.js HTTP", "language": "JavaScript"}, {"summary": {"total": 143, "scored": 125, "passed": 92, "failed": 18, "warnings": 15, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 63.37, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:37 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.0953, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:37 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close (pass), 2xx (warn)", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.8883, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 50.9017, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:37 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 51.1526, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:37 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 51.0697, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:37 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.8575, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:37 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/505 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 51.0255, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.8396, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:37 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.5573, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.5865, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 404, "expected": "400 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 404 \u2014 Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 53.6657, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nX-Powered-By: Express\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 143\r\nDate: Thu, 12 Feb 2026 21:23:37 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n\n\n\n\nError\n\n\n
Cannot GET /path
\n\n\n", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 5001.1242, "rawRequest": "GET /\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.6979, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 50.6634, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 51.6926, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:42 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 50.8487, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with plus sign must be rejected", "scored": true, "durationMs": 51.0356, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 51.2123, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 51.5242, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:42 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 51.3682, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:42 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 51.4255, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 404, "expected": "400 or close", "got": "404", "connectionState": "Open", "reason": "Expected 400 or close, got 404 \u2014 Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.4704, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nX-Powered-By: Express\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 139\r\nDate: Thu, 12 Feb 2026 21:23:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n\n\n\n\nError\n\n\n
Cannot GET *
\n\n\n", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 404, "expected": "2xx", "got": "404", "connectionState": "Open", "reason": "Expected 2xx, got 404 \u2014 OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 51.3717, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nX-Powered-By: Express\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 143\r\nDate: Thu, 12 Feb 2026 21:23:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n\n\n\n\nError\n\n\n
Cannot OPTIONS *
\n\n\n", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400/501 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 51.2451, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 51.5222, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 50.7465, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Pass", "statusCode": 400, "expected": "400/405/501 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.707, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 51.0053, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.691, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 0\r\nETag: W/\"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk\"\r\nDate: Thu, 12 Feb 2026 21:23:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.8111, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 0\r\nETag: W/\"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk\"\r\nDate: Thu, 12 Feb 2026 21:23:43 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5001.0059, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 51.2161, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:48 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 51.3143, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 11\r\nETag: W/\"b-Kq5sNclPz7QV2+lfQIuc6R7oRu0\"\r\nDate: Thu, 12 Feb 2026 21:23:48 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello world", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 51.1874, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 0\r\nETag: W/\"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk\"\r\nDate: Thu, 12 Feb 2026 21:23:48 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5001.4548, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 51.6302, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 0\r\nETag: W/\"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk\"\r\nDate: Thu, 12 Feb 2026 21:23:53 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 51.2674, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:53 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 51.5506, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:53 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Pass", "statusCode": null, "expected": "400/405/501 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "CONNECT to an origin server must be rejected", "scored": true, "durationMs": 0.7334, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Pass", "statusCode": 417, "expected": "417 or 2xx", "got": "417", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.9382, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 417 Expectation Failed\r\nDate: Thu, 12 Feb 2026 21:23:53 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.9575, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:53 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or 400", "got": "200", "connectionState": "Open", "reason": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 51.1366, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:53 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 51.3889, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:54 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Fail", "statusCode": 404, "expected": "405/501 or 2xx", "got": "404", "connectionState": "Open", "reason": "Expected 405/501 or 2xx, got 404 \u2014 TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 51.4814, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nX-Powered-By: Express\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 141\r\nDate: Thu, 12 Feb 2026 21:23:54 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n\n\n\n\nError\n\n\n
Cannot TRACE /
\n\n\n", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 51.0979, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:54 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.6573, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.5622, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.5099, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.4268, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.8559, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:54 GMT\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 50.9114, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:54 GMT\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 50.9263, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:54 GMT\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 400, "expected": "200 or 505", "got": "400", "connectionState": "ClosedByServer", "reason": "Expected 200 or 505, got 400 \u2014 HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 50.6584, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Fail", "statusCode": 404, "expected": "400/405 or 200", "got": "404", "connectionState": "Open", "reason": "Expected 400/405 or 200, got 404 \u2014 TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.8889, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 404 Not Found\r\nX-Powered-By: Express\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 141\r\nDate: Thu, 12 Feb 2026 21:23:54 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n\n\n\n\nError\n\n\n
Cannot TRACE /
\n\n\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 50.9379, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:54 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.7925, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 10\r\nETag: W/\"a-at+xg6SiyUovktq1redipHiJpaE\"\r\nDate: Thu, 12 Feb 2026 21:23:54 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhelloworld", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 49.8195, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 50.7988, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 49.965, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:54 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.5897, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 50.5539, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.5574, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.6232, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.5162, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 0.2708, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.8814, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:55 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 49.7716, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 49.8863, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:55 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 50.6845, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.7436, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.8198, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 50.7059, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 50.8265, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:55 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.6293, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 51.1325, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.7666, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.8017, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:55 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 50.7531, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.7167, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 49.7896, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.5865, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.553, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with leading space must be rejected", "scored": true, "durationMs": 49.7451, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.7151, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.8975, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.7527, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.8634, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 50.727, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 49.7211, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.7109, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.6598, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.6701, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 51.0029, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:56 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 49.7351, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative chunk size must be rejected", "scored": true, "durationMs": 50.8031, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 51.0884, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:56 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.8647, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.6935, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Fail", "statusCode": 100, "expected": "400 or 2xx", "got": "100", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 100 \u2014 Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.7274, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 100 Continue\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.6979, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:56 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.8383, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.8704, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:56 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.9114, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:56 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.8266, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:57 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 51.0243, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nAllow: GET,HEAD,POST\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 13\r\nETag: W/\"d-bMedpZYGrVt1nR4x+qdNZ2GqyRo\"\r\nDate: Thu, 12 Feb 2026 21:23:57 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nGET,HEAD,POST", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.5776, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.5957, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.8385, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 0\r\nETag: W/\"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk\"\r\nDate: Thu, 12 Feb 2026 21:23:57 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 49.9557, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 200\r\nETag: W/\"c8-KcGVM93JXf68/JJNjkF5IIKlj94\"\r\nDate: Thu, 12 Feb 2026 21:23:57 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 50.6159, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.7455, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 50.9782, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 51.2105, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:57 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.8591, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:23:57 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.6624, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.9695, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:23:57 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 50.7601, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/414/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 52.2013, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 51.2139, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 51.3963, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in URL should be rejected", "scored": true, "durationMs": 49.7666, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Control characters in header value should be rejected", "scored": true, "durationMs": 50.7887, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5001.5034, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.6057, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 51.1108, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB method name should be rejected", "scored": true, "durationMs": 50.9935, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.5539, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 404, "expected": "400 or close", "got": "404", "connectionState": "Open", "reason": "Expected 400 or close, got 404 \u2014 Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.7677, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nX-Powered-By: Express\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 154\r\nDate: Thu, 12 Feb 2026 21:24:08 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n\n\n\n\nError\n\n\n
Cannot GET /caf%C3%83%C2%A9
\n\n\n", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 50.4495, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 50.5111, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in header value should be rejected", "scored": true, "durationMs": 50.4034, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 50.4494, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/505/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 50.522, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.3537, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.7905, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: application/octet-stream\r\nContent-Length: 5\r\nETag: W/\"5-qvTGHdzF6KLavt4PO0gs2a6pQ00\"\r\nDate: Thu, 12 Feb 2026 21:24:08 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nhello", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 50.6927, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nX-Powered-By: Express\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 148\r\nDate: Thu, 12 Feb 2026 21:24:08 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n\n\n\n\nError\n\n\n
Cannot GET /path\\file
\n\n\n", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 404, "expected": "400 or close", "got": "404", "connectionState": "Open", "reason": "Expected 400 or close, got 404 \u2014 Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 50.5365, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nX-Powered-By: Express\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 151\r\nDate: Thu, 12 Feb 2026 21:24:08 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n\n\n\n\nError\n\n\n
Cannot GET /%C3%80%C2%AF
\n\n\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 50.9791, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nX-Powered-By: Express\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 151\r\nDate: Thu, 12 Feb 2026 21:24:08 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n\n\n\n\nError\n\n\n
Cannot GET /path%00.html
\n\n\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 50.7585, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 Not Found\r\nX-Powered-By: Express\r\nContent-Security-Policy: default-src 'none'\r\nX-Content-Type-Options: nosniff\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 167\r\nDate: Thu, 12 Feb 2026 21:24:08 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\n\n\n\n\nError\n\n\n
Cannot GET /path%0d%0aX-Injected:%20true
\n\n\n", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 413, "expected": "400 or 2xx", "got": "413", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 413 \u2014 64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 52.1877, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.1 413 Payload Too Large\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 52.5594, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nETag: W/\"2-nOO9QiTIwXgNtWtBJezz8kv3SLc\"\r\nDate: Thu, 12 Feb 2026 21:24:08 GMT\r\nConnection: keep-alive\r\nKeep-Alive: timeout=5\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5000.5129, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "Express", "language": "JavaScript"}, {"summary": {"total": 143, "scored": 125, "passed": 38, "failed": 63, "warnings": 24, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 64.1275, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:41 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "ClosedByServer", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.5278, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:41 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "ClosedByServer", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.1228, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:41 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400, got 200 \u2014 Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 50.9901, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:42 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400, got 200 \u2014 Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 51.3224, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:42 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 51.0584, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:42 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400, got 200 \u2014 Request without Host header must be rejected with 400", "scored": true, "durationMs": 51.1509, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:42 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400/505 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 0.8707, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 51.087, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:42 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": null, "expected": "400", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Expected 400, got ClosedByServer \u2014 CR without LF as line ending must be rejected", "scored": true, "durationMs": 0.8828, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 11.2157, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 51.1402, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:42 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 5001.4755, "rawRequest": "GET /\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.3884, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Header line without colon must be rejected", "scored": true, "durationMs": 50.9732, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.7464, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 51.0015, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with plus sign must be rejected", "scored": true, "durationMs": 51.0586, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Whitespace before first header line must be rejected", "scored": true, "durationMs": 51.0661, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.9032, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 51.169, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 51.0055, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 51.1805, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 51.0511, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400/501 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400/501 or close, got 200 \u2014 Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 51.1108, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": null, "expected": "400 or 2xx", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 0.3919, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 51.1408, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Warn", "statusCode": 200, "expected": "400/405/501 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 51.0866, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:48 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 51.0159, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:48 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "ClosedByServer", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 51.0346, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:48 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "ClosedByServer", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 51.0915, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:48 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5000.8786, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 51.7321, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:53 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 51.0045, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:53 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 11\r\nConnection: close\r\n\r\nhello world", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 50.8687, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:53 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5000.3863, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 400, "expected": "!101", "got": "400", "connectionState": "ClosedByServer", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 51.2851, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 400 BAD REQUEST\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 167\r\nConnection: close\r\n\r\n\n\n400 Bad Request\n

Bad Request

\n

The browser (or proxy) sent a request that this server could not understand.

\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "ClosedByServer", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 51.0085, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "ClosedByServer", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 51.0268, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Fail", "statusCode": 200, "expected": "400/405/501 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400/405/501 or close, got 200 \u2014 CONNECT to an origin server must be rejected", "scored": true, "durationMs": 51.0958, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "417 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 51.1795, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.881, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 500, "expected": "2xx or 400", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 2xx or 400, got 500 \u2014 Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 51.3861, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Fail", "statusCode": 400, "expected": "426 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Expected 426 or 2xx, got 400 \u2014 WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 51.0216, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 400 BAD REQUEST\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 167\r\nConnection: close\r\n\r\n\n\n400 Bad Request\n

Bad Request

\n

The browser (or proxy) sent a request that this server could not understand.

\n", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "405/501 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 50.9237, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 51.0373, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.9836, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 0.6404, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.5053, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 0.6198, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.8372, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:58 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 51.1858, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 51.0315, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Warn", "statusCode": 200, "expected": "200 or 505", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 51.1331, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "400/405 or 200", "got": "200", "connectionState": "ClosedByServer", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 51.4576, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Fail", "statusCode": 500, "expected": "2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 2xx, got 500 \u2014 Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 51.7031, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 51.091, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 10\r\nConnection: close\r\n\r\nhelloworld", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 51.1471, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": "Used TE (chunked 0-length \u2192 empty body)"}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 51.1806, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 10\r\nConnection: close\r\n\r\nhelloworld", "behavioralNote": "Used second CL (10 bytes)"}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.9098, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 51.1161, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:45:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 4999.7948, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 51.7129, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:04 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": "Used TE (treated as chunked)"}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Negative Content-Length must be rejected", "scored": true, "durationMs": 50.82, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:04 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "TimedOut", "reason": "Expected 400 or close, got 200 \u2014 CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 5001.2088, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:04 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "TimedOut", "reason": "Expected 400 or close, got 200 \u2014 TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 5001.7333, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:09 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 51.2029, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:14 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 51.2511, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:14 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.8585, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:14 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 5000.9371, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 51.7009, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:19 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 51.0149, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:19 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 5000.431, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 51.8681, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:24 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.9615, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:24 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 51.0222, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.9653, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 16\r\nConnection: close\r\n\r\nhello world!!!!!", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.9303, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 51.0064, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 51.2549, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\n", "behavioralNote": "Used TE (treated as chunked)"}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.8914, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 49.9664, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 51.2946, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with leading space must be rejected", "scored": true, "durationMs": 51.1973, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 51.7241, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 51.8133, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 51.2511, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 51.068, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 51.3776, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 51.1065, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:25 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 5000.3472, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 5000.8455, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 51.5911, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:35 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\n", "behavioralNote": "Used TE (treated as chunked)"}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 51.0847, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:35 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 51.1059, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:35 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Negative chunk size must be rejected", "scored": true, "durationMs": 50.4409, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:35 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.9811, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:35 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.088, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.9237, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Fail", "statusCode": 100, "expected": "400 or 2xx", "got": "100", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 100 \u2014 Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.765, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 100 Continue\r\n\r\nHTTP/1.1 100 Continue\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 51.5309, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 51.2781, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 51.2714, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 51.3456, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.9902, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 51.1384, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.916, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.9624, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 51.3054, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 51.2977, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:36 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 200\r\nConnection: close\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": null, "expected": "400", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400, got TimedOut \u2014 Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 5000.441, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 51.7338, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:41 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\nhello", "behavioralNote": "Used CL (ignored TE variant)"}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 5000.6487, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 51.8785, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:46 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 51.031, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:46 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 500, "expected": "400 or close", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 500 \u2014 Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 51.7973, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:46 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 51.6488, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:46 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 0.9069, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 414, "expected": "400/414/431 or close", "got": "414", "connectionState": "ClosedByServer", "reason": "100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 50.8257, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 414 Request-URI Too Long\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:46 GMT\r\nConnection: close\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: 327\r\n\r\n\n\n \n \n Error response\n \n \n

Error response

\n

Error code: 414

\n

Message: Request-URI Too Long.

\n

Error code explanation: 414 - URI is too long.

\n \n\n", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 50.9053, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 431 Line too long\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:47 GMT\r\nConnection: close\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: 355\r\n\r\n\n\n \n \n Error response\n \n \n

Error response

\n

Error code: 431

\n

Message: Line too long.

\n

Error code explanation: 431 - got more than 65536 bytes when reading header line.

\n \n\n", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 51.3725, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 431 Too many headers\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:47 GMT\r\nConnection: close\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: 333\r\n\r\n\n\n \n \n Error response\n \n \n

Error response

\n

Error code: 431

\n

Message: Too many headers.

\n

Error code explanation: 431 - got more than 100 headers.

\n \n\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in URL should be rejected", "scored": true, "durationMs": 50.9945, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Control characters in header value should be rejected", "scored": true, "durationMs": 50.8824, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:47 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5000.6172, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.6772, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 50.7563, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 431 Line too long\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:57 GMT\r\nConnection: close\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: 355\r\n\r\n\n\n \n \n Error response\n \n \n

Error response

\n

Error code: 431

\n

Message: Line too long.

\n

Error code explanation: 431 - got more than 65536 bytes when reading header line.

\n \n\n", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 414, "expected": "400 or close", "got": "414", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 414 \u2014 100KB method name should be rejected", "scored": true, "durationMs": 51.0386, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 414 Request-URI Too Long\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:57 GMT\r\nConnection: close\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: 327\r\n\r\n\n\n \n \n Error response\n \n \n

Error response

\n

Error code: 414

\n

Message: Request-URI Too Long.

\n

Error code explanation: 414 - URI is too long.

\n \n\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.9741, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:57 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.9207, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:46:57 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 5000.5928, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 0.8114, "rawRequest": " \r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in header value should be rejected", "scored": true, "durationMs": 50.9623, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:47:02 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 5000.197, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/505/close/timeout", "got": "ClosedByServer", "connectionState": "ClosedByServer", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 2.5621, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Empty Content-Length value must be rejected", "scored": true, "durationMs": 54.1712, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:47:07 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 52.5457, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:47:07 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 5\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "ClosedByServer", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 56.0703, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:47:07 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 60.2127, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:47:07 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "ClosedByServer", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 55.8076, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:47:07 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 404, "expected": "400 or 2xx/404", "got": "404", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 59.0245, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 404 NOT FOUND\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:47:07 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 207\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 500, "expected": "400 or 2xx", "got": "500", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 500 \u2014 64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 62.2175, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.1 500 INTERNAL SERVER ERROR\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:47:07 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 265\r\nConnection: close\r\n\r\n\n\n500 Internal Server Error\n

Internal Server Error

\n

The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

\n", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 68.5472, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: Werkzeug/3.1.5 Python/3.12.3\r\nDate: Thu, 12 Feb 2026 21:47:07 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5000.6755, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "Flask", "language": "Python"}, {"summary": {"total": 143, "scored": 125, "passed": 78, "failed": 31, "warnings": 16, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 63.2272, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:28 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close (pass), 2xx (warn)", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.417, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 218\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Version 'Invalid HTTP Version: 'HTTP/1.1\\nHost: localhost:8080''\n \n\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close (pass), 2xx (warn)", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.571, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 158\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'HOST'\n \n\n", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 50.558, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 178\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Obsolete line folding is unacceptable: 'X-TEST'\n \n\n", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.369, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 166\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP header name: 'X-Test '\n \n\n", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 50.5926, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 208\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid Request Line 'Invalid HTTP request line: 'GET / HTTP/1.1''\n \n\n", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.5195, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:29 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/505 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.5395, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 182\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Version 'Invalid HTTP Version: (9, 9)'\n \n\n", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.4506, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 166\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: ': empty-name'\n \n\n", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.4133, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 218\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Version 'Invalid HTTP Version: 'HTTP/1.1\\rHost: localhost:8080''\n \n\n", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.5105, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 205\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid Request Line 'Invalid HTTP request line: 'GET HTTP/1.1''\n \n\n", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 50.6666, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:29 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 50.5421, "rawRequest": "GET /\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 198\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid Request Line 'Invalid HTTP request line: 'GET /''\n \n\n", "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.5051, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 167\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP header name: 'Bad[Name'\n \n\n", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 50.3649, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 165\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'NoColonHere'\n \n\n", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.5603, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:29 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 50.4725, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with plus sign must be rejected", "scored": true, "durationMs": 50.5542, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 50.569, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 155\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: ' '\n \n\n", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.756, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:29 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.6329, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:30 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 50.7391, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:30 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.7021, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:30 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 50.5281, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:30 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400/501 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400/501 or close, got 200 \u2014 Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 50.7119, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:30 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 50.6874, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 193\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid Request Line 'Invalid HTTP request line: '''\n \n\n", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 50.6224, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:30 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Pass", "statusCode": 400, "expected": "400/405/501 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.6706, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 184\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid Method 'Invalid HTTP method: 'get''\n \n\n", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 50.617, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:30 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.5424, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:30 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.5661, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:30 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5001.7343, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 50.5848, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:35 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 50.5404, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:35 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 50.5389, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:35 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "400/close/timeout", "got": "200", "connectionState": "ClosedByServer", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 50.7832, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:35 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 50.6355, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:35 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "ClosedByServer", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 50.7589, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:35 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.6903, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:35 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Fail", "statusCode": 200, "expected": "400/405/501 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/405/501 or close, got 200 \u2014 CONNECT to an origin server must be rejected", "scored": true, "durationMs": 50.6098, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:35 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Pass", "statusCode": 417, "expected": "417 or 2xx", "got": "417", "connectionState": "ClosedByServer", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.758, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 417 Expectation Failed\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 188\r\n\r\n\n \n Expectation Failed\n \n \n

Expectation Failed

\n Unable to comply with expectation: '200-ok'\n \n\n", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.7496, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or 400", "got": "200", "connectionState": "Open", "reason": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 50.688, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.8859, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 50.579, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 50.4682, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 51.8408, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 208\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid Request Line 'Invalid HTTP request line: 'GET\\t/ HTTP/1.1''\n \n\n", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.5515, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 194\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Version 'Invalid HTTP Version: 'HTTP/1''\n \n\n", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.7971, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 198\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Version 'Invalid HTTP Version: 'HTTP/01.01''\n \n\n", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.7982, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 197\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Version 'Invalid HTTP Version: 'HTTP/ 1.1''\n \n\n", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.904, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 50.7442, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.0 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 50.6616, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.0 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\nOK", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Warn", "statusCode": 200, "expected": "200 or 505", "got": "200", "connectionState": "ClosedByServer", "reason": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 50.7509, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.2 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "400/405 or 200", "got": "200", "connectionState": "Open", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.642, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 50.6925, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.5888, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 50.9641, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 50.6354, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.5931, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:36 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n5\r\nhello\r\n", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 501 \u2014 Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.7664, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 170\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Unsupported transfer coding: 'xchunked'\n \n\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 50.9132, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.6107, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 177\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP header name: 'Transfer-Encoding '\n \n\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.7714, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.5704, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 0.3664, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.7751, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:37 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.8504, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 171\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'TRANSFER-ENCODING'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.7259, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:37 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n5\r\nhello\r\n", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 50.8226, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.5625, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.5705, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 171\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'TRANSFER-ENCODING'\n \n\n", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 50.4617, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 171\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'TRANSFER-ENCODING'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 50.5737, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:37 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.5369, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 160\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'X-TEST'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 50.566, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.538, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:37 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or close", "got": "501", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 501 \u2014 Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.5948, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 162\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Unsupported transfer coding: ''\n \n\n", "behavioralNote": null}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 50.6851, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 171\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Unsupported transfer coding: ', chunked'\n \n\n", "behavioralNote": null}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.6045, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 171\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'TRANSFER-ENCODING'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.6085, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:37 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.7532, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.5955, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with leading space must be rejected", "scored": true, "durationMs": 50.6996, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.4792, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.5769, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.4709, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.7422, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 50.6551, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 50.6842, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.7172, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.5901, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 49.7134, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 171\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'TRANSFER-ENCODING'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.729, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.9367, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": "Body: 5\r\nhello\r\n0"}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Negative chunk size must be rejected", "scored": true, "durationMs": 50.4684, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.7366, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": "Body: 5\r\nhello\r\n0"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 50.8333, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.5365, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 177\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Unsupported transfer coding: 'chunked;ext=val'\n \n\n", "behavioralNote": null}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Fail", "statusCode": 100, "expected": "400 or 2xx", "got": "100", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 100 \u2014 Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.5493, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 100 Continue\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.5505, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.6186, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:38 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.5122, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:39 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.5891, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:39 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.826, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:39 GMT\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\nOK", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 50.6553, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:39 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.4851, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.6086, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.6501, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:39 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 50.7093, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:39 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 50.5078, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 189\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Obsolete line folding is unacceptable: 'TRANSFER-ENCODING'\n \n\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Fail", "statusCode": 501, "expected": "400 or 2xx", "got": "501", "connectionState": "ClosedByServer", "reason": "Expected 400 or 2xx, got 501 \u2014 Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 51.0751, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 501 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 170\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Unsupported transfer coding: 'chunked,'\n \n\n", "behavioralNote": null}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 51.1137, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 51.0542, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:39 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 50.8514, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:39 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.6342, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:39 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.681, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:39 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 5000.5685, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/414/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 51.4053, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 163\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Request Line is too large (8192 > 4094)\n \n\n", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header value should be rejected with 431", "scored": true, "durationMs": 51.9932, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 229\r\n\r\n\n \n Request Header Fields Too Large\n \n \n

Request Header Fields Too Large

\n Error parsing headers: 'limit request headers fields size'\n \n\n", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 52.9644, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 224\r\n\r\n\n \n Request Header Fields Too Large\n \n \n

Request Header Fields Too Large

\n Error parsing headers: 'limit request headers fields'\n \n\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in URL should be rejected", "scored": true, "durationMs": 50.5559, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:44 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Control characters in header value should be rejected", "scored": true, "durationMs": 50.4982, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:44 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 4999.6057, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.9109, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 431, "expected": "400/431 or close", "got": "431", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 51.017, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 431 Request Header Fields Too Large\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 229\r\n\r\n\n \n Request Header Fields Too Large\n \n \n

Request Header Fields Too Large

\n Error parsing headers: 'limit request headers fields size'\n \n\n", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB method name should be rejected", "scored": true, "durationMs": 50.8706, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 163\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Request Line is too large (8192 > 4094)\n \n\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.527, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 166\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP header name: 'X-T??st'\n \n\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.6108, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:47:55 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 5000.3473, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 50.5651, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 181\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid Method 'Invalid HTTP method: '''\n \n\n", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in header value should be rejected", "scored": true, "durationMs": 50.381, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 160\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'X-TEST'\n \n\n", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 50.4732, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:48:00 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/505/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 50.6012, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 182\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Version 'Invalid HTTP Version: (2, 0)'\n \n\n", "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.3478, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Type: text/html\r\nContent-Length: 168\r\n\r\n\n \n Bad Request\n \n \n

Bad Request

\n Invalid HTTP Header: 'CONTENT-LENGTH'\n \n\n", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.479, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:48:00 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n5\r\nhello\r\n", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "ClosedByServer", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 50.4149, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:48:00 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400 or close, got 200 \u2014 Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 50.5768, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:48:00 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "ClosedByServer", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 50.7562, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:48:00 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 50.523, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:48:00 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "ClosedByServer", "reason": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 51.5823, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:48:00 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "ClosedByServer", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 51.4276, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\nServer: gunicorn\r\nDate: Thu, 12 Feb 2026 21:48:00 GMT\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/plain\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5000.599, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "Gunicorn", "language": "Python"}, {"summary": {"total": 143, "scored": 125, "passed": 85, "failed": 20, "warnings": 20, "unscored": 18}, "results": [{"id": "COMP-BASELINE", "description": "Valid GET request \u2014 confirms server is reachable", "category": "Compliance", "rfc": null, "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid GET request \u2014 confirms server is reachable", "scored": true, "durationMs": 62.3402, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:25 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-REQUEST-LINE", "description": "Bare LF in request line should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in request line should be rejected, but MAY be accepted", "scored": true, "durationMs": 51.7448, "rawRequest": "GET / HTTP/1.1\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:25 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "RFC9112-2.2-BARE-LF-HEADER", "description": "Bare LF in header should be rejected, but MAY be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or close (pass), 2xx (warn)", "got": "200", "connectionState": "Open", "reason": "Bare LF in header should be rejected, but MAY be accepted", "scored": true, "durationMs": 50.9861, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\nX-Test: value\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:25 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5.1-OBS-FOLD", "description": "Obs-fold (line folding) in headers should be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": 200, "expected": "400", "got": "200", "connectionState": "Open", "reason": "Expected 400, got 200 \u2014 Obs-fold (line folding) in headers should be rejected", "scored": true, "durationMs": 50.9678, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value\r\n continued\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:25 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9110-5.6.2-SP-BEFORE-COLON", "description": "Whitespace between header name and colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace between header name and colon must be rejected", "scored": true, "durationMs": 50.7578, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test : value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "RFC9112-3-MULTI-SP-REQUEST-LINE", "description": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "ClosedByServer", "reason": "Multiple spaces between request-line components \u2014 SHOULD reject but MAY parse leniently", "scored": true, "durationMs": 50.9517, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "RFC9112-7.1-MISSING-HOST", "description": "Request without Host header must be rejected with 400", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Request without Host header must be rejected with 400", "scored": true, "durationMs": 50.7915, "rawRequest": "GET / HTTP/1.1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "RFC9112-2.3-INVALID-VERSION", "description": "Invalid HTTP version must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Fail", "statusCode": 200, "expected": "400/505 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/505 or close, got 200 \u2014 Invalid HTTP version must be rejected", "scored": true, "durationMs": 50.9502, "rawRequest": "GET / HTTP/9.9\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:25 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-5-EMPTY-HEADER-NAME", "description": "Empty header name (leading colon) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty header name (leading colon) must be rejected", "scored": true, "durationMs": 50.8482, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\n: empty-name\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "RFC9112-3-CR-ONLY-LINE-ENDING", "description": "CR without LF as line ending must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "CR without LF as line ending must be rejected", "scored": true, "durationMs": 50.7359, "rawRequest": "GET / HTTP/1.1\rHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "RFC9112-3-MISSING-TARGET", "description": "Request line with no target (space but no path) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Request line with no target (space but no path) must be rejected", "scored": true, "durationMs": 50.6041, "rawRequest": "GET HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "RFC9112-3.2-FRAGMENT-IN-TARGET", "description": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Fragment (#) in request-target \u2014 not part of origin-form grammar", "scored": true, "durationMs": 49.9003, "rawRequest": "GET /path#frag HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:25 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-2.3-HTTP09-REQUEST", "description": "HTTP/0.9 request (no version) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "HTTP/0.9 request (no version) must be rejected", "scored": true, "durationMs": 5001.6638, "rawRequest": "GET /\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "RFC9112-5-INVALID-HEADER-NAME", "description": "Header name with invalid characters (brackets) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Header name with invalid characters (brackets) must be rejected", "scored": true, "durationMs": 50.6074, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nBad[Name: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "RFC9112-5-HEADER-NO-COLON", "description": "Header line without colon must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Header line without colon must be rejected", "scored": true, "durationMs": 50.9886, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nNoColonHere\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9110-5.4-DUPLICATE-HOST", "description": "Duplicate Host headers with different values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "Open", "reason": "Duplicate Host headers with different values must be rejected", "scored": true, "durationMs": 50.9107, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-NON-NUMERIC", "description": "Non-numeric Content-Length must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Non-numeric Content-Length must be rejected", "scored": true, "durationMs": 50.9071, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: abc\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "RFC9112-6.1-CL-PLUS-SIGN", "description": "Content-Length with plus sign must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with plus sign must be rejected", "scored": true, "durationMs": 51.3316, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: +5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "COMP-WHITESPACE-BEFORE-HEADERS", "description": "Whitespace before first header line must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace before first header line must be rejected", "scored": true, "durationMs": 50.9102, "rawRequest": "GET / HTTP/1.1\r\n \r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "COMP-DUPLICATE-HOST-SAME", "description": "Duplicate Host headers with identical values must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Pass", "statusCode": 400, "expected": "400", "got": "400", "connectionState": "ClosedByServer", "reason": "Duplicate Host headers with identical values must be rejected", "scored": true, "durationMs": 50.7826, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "COMP-HOST-WITH-USERINFO", "description": "Host header with userinfo (user@host) must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with userinfo (user@host) must be rejected", "scored": true, "durationMs": 50.8792, "rawRequest": "GET / HTTP/1.1\r\nHost: user@localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:31 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-WITH-PATH", "description": "Host header with path component must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with path component must be rejected", "scored": true, "durationMs": 50.8227, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080/path\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:31 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n", "behavioralNote": null}, {"id": "COMP-ASTERISK-WITH-GET", "description": "Asterisk-form (*) request-target with GET must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Asterisk-form (*) request-target with GET must be rejected", "scored": true, "durationMs": 50.74, "rawRequest": "GET * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:31 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-OPTIONS-STAR", "description": "OPTIONS * is the only valid asterisk-form request", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.4", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS * is the only valid asterisk-form request", "scored": true, "durationMs": 50.6152, "rawRequest": "OPTIONS * HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:31 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UNKNOWN-TE-501", "description": "Unknown Transfer-Encoding without CL should be rejected with 501", "category": "Compliance", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400/501 or close", "got": "400", "connectionState": "Open", "reason": "Unknown Transfer-Encoding without CL should be rejected with 501", "scored": true, "durationMs": 50.5608, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: gzip\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-LEADING-CRLF", "description": "Leading CRLF before request-line \u2014 server may ignore per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Leading CRLF before request-line \u2014 server may ignore per RFC", "scored": true, "durationMs": 50.7038, "rawRequest": "\r\n\r\nGET / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-ABSOLUTE-FORM", "description": "Absolute-form request-target \u2014 server should accept per RFC", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form request-target \u2014 server should accept per RFC", "scored": true, "durationMs": 51.0306, "rawRequest": "GET http://localhost:8080/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:31 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CASE", "description": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "category": "Compliance", "rfc": "RFC 9110 \u00a79.1", "verdict": "Warn", "statusCode": 200, "expected": "400/405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "Lowercase method 'get' \u2014 methods are case-sensitive per RFC", "scored": true, "durationMs": 50.7818, "rawRequest": "get / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:31 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-BODY", "description": "POST with Content-Length and matching body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length and matching body must be accepted", "scored": true, "durationMs": 50.7804, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:31 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-ZERO", "description": "POST with Content-Length: 0 and no body must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with Content-Length: 0 and no body must be accepted", "scored": true, "durationMs": 50.9257, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:31 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-NO-CL-NO-TE", "description": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "POST with neither Content-Length nor Transfer-Encoding \u2014 implicit zero-length body", "scored": true, "durationMs": 50.7413, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:31 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-POST-CL-UNDERSEND", "description": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "category": "Compliance", "rfc": "RFC 9112 \u00a76.2", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 10 but only 5 bytes sent \u2014 incomplete body", "scored": true, "durationMs": 5001.0503, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 10\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-CHUNKED-BODY", "description": "Valid single-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid single-chunk POST must be accepted", "scored": true, "durationMs": 50.7019, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:36 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-MULTI", "description": "Valid multi-chunk POST must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid multi-chunk POST must be accepted", "scored": true, "durationMs": 50.571, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:36 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EMPTY", "description": "Zero-length chunked body (just terminator) must be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or close", "got": "200", "connectionState": "Open", "reason": "Zero-length chunked body (just terminator) must be accepted", "scored": true, "durationMs": 50.628, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:36 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-NO-FINAL", "description": "Chunked body without zero terminator \u2014 incomplete transfer", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunked body without zero terminator \u2014 incomplete transfer", "scored": true, "durationMs": 5000.5766, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "COMP-UPGRADE-POST", "description": "WebSocket upgrade via POST must not be accepted", "category": "Compliance", "rfc": "RFC 6455 \u00a74.1", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade via POST must not be accepted", "scored": true, "durationMs": 50.8872, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-MISSING-CONN", "description": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade header without Connection: Upgrade must not trigger protocol switch", "scored": true, "durationMs": 50.7074, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-UNKNOWN", "description": "Upgrade to unknown protocol must not return 101", "category": "Compliance", "rfc": "RFC 9110 \u00a77.8", "verdict": "Pass", "statusCode": 200, "expected": "!101", "got": "200", "connectionState": "Open", "reason": "Upgrade to unknown protocol must not return 101", "scored": true, "durationMs": 50.7407, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: totally-made-up/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-CONNECT", "description": "CONNECT to an origin server must be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.6", "verdict": "Fail", "statusCode": 200, "expected": "400/405/501 or close", "got": "200", "connectionState": "ClosedByServer", "reason": "Expected 400/405/501 or close, got 200 \u2014 CONNECT to an origin server must be rejected", "scored": true, "durationMs": 50.9229, "rawRequest": "CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\n\r\n", "behavioralNote": null}, {"id": "COMP-EXPECT-UNKNOWN", "description": "Unknown Expect value should be rejected with 417", "category": "Compliance", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Warn", "statusCode": 200, "expected": "417 or 2xx", "got": "200", "connectionState": "Open", "reason": "Unknown Expect value should be rejected with 417", "scored": true, "durationMs": 50.8266, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nExpect: 200-ok\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-GET-WITH-CL-BODY", "description": "GET with Content-Length and body \u2014 semantically unusual", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "GET with Content-Length and body \u2014 semantically unusual", "scored": false, "durationMs": 50.6728, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-EXTENSION", "description": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx or 400", "got": "200", "connectionState": "Open", "reason": "Chunk extension (valid per RFC) \u2014 server should accept or may reject", "scored": true, "durationMs": 50.7213, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=value\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-UPGRADE-INVALID-VER", "description": "WebSocket upgrade with unsupported version \u2014 should return 426", "category": "Compliance", "rfc": "RFC 6455 \u00a74.4", "verdict": "Warn", "statusCode": 200, "expected": "426 or 2xx", "got": "200", "connectionState": "Open", "reason": "WebSocket upgrade with unsupported version \u2014 should return 426", "scored": true, "durationMs": 50.6581, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 99\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-METHOD-TRACE", "description": "TRACE request \u2014 should be disabled in production", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "405/501 or 2xx", "got": "200", "connectionState": "Open", "reason": "TRACE request \u2014 should be disabled in production", "scored": false, "durationMs": 50.669, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HOST-EMPTY-VALUE", "description": "Empty Host header value must be rejected", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Empty Host header value must be rejected", "scored": true, "durationMs": 50.6745, "rawRequest": "GET / HTTP/1.1\r\nHost: \r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-REQUEST-LINE-TAB", "description": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "category": "Compliance", "rfc": "RFC 9112 \u00a73", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Tab as request-line delimiter \u2014 SHOULD reject but MAY parse on whitespace", "scored": true, "durationMs": 50.5793, "rawRequest": "GET\t/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-VERSION-MISSING-MINOR", "description": "HTTP/1 with no minor version digit is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/1 with no minor version digit is invalid", "scored": true, "durationMs": 50.4651, "rawRequest": "GET / HTTP/1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "COMP-VERSION-LEADING-ZEROS", "description": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/01.01 \u2014 leading zeros in version digits are invalid", "scored": true, "durationMs": 50.5344, "rawRequest": "GET / HTTP/01.01\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "COMP-VERSION-WHITESPACE", "description": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "HTTP/ 1.1 \u2014 whitespace inside version token is invalid", "scored": true, "durationMs": 50.6245, "rawRequest": "GET / HTTP/ 1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "COMP-CONNECTION-CLOSE", "description": "Server must close connection after responding to Connection: close", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Fail", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "Open", "reason": "Expected 2xx + close, got 200 \u2014 Server must close connection after responding to Connection: close", "scored": true, "durationMs": 50.7503, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nConnection: close\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HTTP10-DEFAULT-CLOSE", "description": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "category": "Compliance", "rfc": "RFC 9112 \u00a79.3", "verdict": "Warn", "statusCode": 200, "expected": "2xx + close", "got": "200", "connectionState": "Open", "reason": "HTTP/1.0 without keep-alive \u2014 server should close connection after response", "scored": true, "durationMs": 50.7274, "rawRequest": "GET / HTTP/1.0\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HTTP10-NO-HOST", "description": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "category": "Compliance", "rfc": "RFC 9112 \u00a73.2", "verdict": "Warn", "statusCode": 200, "expected": "200 or 400", "got": "200", "connectionState": "Open", "reason": "HTTP/1.0 without Host header \u2014 valid per HTTP/1.0", "scored": false, "durationMs": 50.7014, "rawRequest": "GET / HTTP/1.0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "COMP-HTTP12-VERSION", "description": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "category": "Compliance", "rfc": "RFC 9112 \u00a72.3", "verdict": "Warn", "statusCode": 200, "expected": "200 or 505", "got": "200", "connectionState": "Open", "reason": "HTTP/1.2 \u2014 higher minor version should be accepted as HTTP/1.x compatible", "scored": false, "durationMs": 50.7373, "rawRequest": "GET / HTTP/1.2\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "COMP-TRACE-WITH-BODY", "description": "TRACE with Content-Length body should be rejected", "category": "Compliance", "rfc": "RFC 9110 \u00a79.3.8", "verdict": "Warn", "statusCode": 200, "expected": "400/405 or 200", "got": "200", "connectionState": "Open", "reason": "TRACE with Content-Length body should be rejected", "scored": false, "durationMs": 50.9078, "rawRequest": "TRACE / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-TRAILER-VALID", "description": "Valid chunked body with trailer field should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1.2", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Valid chunked body with trailer field should be accepted", "scored": true, "durationMs": 50.6654, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX-Checksum: abc\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:42 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "COMP-CHUNKED-HEX-UPPERCASE", "description": "Chunk size with uppercase hex (A = 10) should be accepted", "category": "Compliance", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 200, "expected": "2xx", "got": "200", "connectionState": "Open", "reason": "Chunk size with uppercase hex (A = 10) should be accepted", "scored": true, "durationMs": 50.5743, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nA\r\nhelloworld\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:43 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TE-BOTH", "description": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Both Content-Length and Transfer-Encoding present \u2014 server MAY reject or process with TE alone", "scored": true, "durationMs": 50.8954, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:43 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": "Used TE (chunked 0-length \u2192 empty body)"}, {"id": "SMUG-DUPLICATE-CL", "description": "Duplicate Content-Length with different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Duplicate Content-Length with different values must be rejected", "scored": true, "durationMs": 50.7197, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS", "description": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with leading zeros \u2014 valid per 1*DIGIT grammar but may cause parser disagreement", "scored": true, "durationMs": 50.7336, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 005\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:43 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-XCHUNKED", "description": "Transfer-Encoding: xchunked must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding: xchunked must not be treated as chunked", "scored": true, "durationMs": 50.6049, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-SPACE", "description": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding: 'chunked ' (trailing space) must not be treated as chunked", "scored": true, "durationMs": 5000.019, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-SP-BEFORE-COLON", "description": "Transfer-Encoding with space before colon must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding with space before colon must be rejected", "scored": true, "durationMs": 50.5502, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE", "description": "Negative Content-Length must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Negative Content-Length must be rejected", "scored": true, "durationMs": 50.5137, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -1\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CLTE-PIPELINE", "description": "CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 CL.TE smuggling probe \u2014 follow-up should not receive smuggled response", "scored": true, "durationMs": 0.621, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:48 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TECL-PIPELINE", "description": "TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 TE.CL smuggling probe \u2014 TE: chunked + CL: 30 with pipelined GET", "scored": true, "durationMs": 0.4612, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 30\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:48 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-TRAILING-SPACE", "description": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with trailing space \u2014 OWS trimming is valid per RFC 9110 \u00a75.5", "scored": true, "durationMs": 50.4525, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5 \r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:48 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DOUBLE-CHUNKED", "description": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding: chunked, chunked with CL is ambiguous", "scored": true, "durationMs": 50.5739, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-EXTRA-LEADING-SP", "description": "Content-Length with extra leading whitespace (double space OWS)", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with extra leading whitespace (double space OWS)", "scored": true, "durationMs": 50.6447, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:48 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-CASE-MISMATCH", "description": "Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding: Chunked (capital C) with CL \u2014 case-insensitive is valid", "scored": true, "durationMs": 5000.7292, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CL-COMMA-DIFFERENT", "description": "Content-Length with comma-separated different values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with comma-separated different values must be rejected", "scored": true, "durationMs": 50.6604, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 10\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "SMUG-TE-NOT-FINAL-CHUNKED", "description": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.3", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding where chunked is not final \u2014 server MUST respond with 400 (RFC 9112 \u00a76.3)", "scored": true, "durationMs": 50.4817, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked, gzip\r\n\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "SMUG-TE-HTTP10", "description": "Transfer-Encoding in HTTP/1.0 request must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Transfer-Encoding in HTTP/1.0 request must be rejected", "scored": true, "durationMs": 5000.3278, "rawRequest": "POST / HTTP/1.0\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-SEMICOLON", "description": "Chunk size with bare semicolon and no extension name must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Chunk size with bare semicolon and no extension name must be rejected", "scored": true, "durationMs": 50.9338, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:58 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-BARE-CR-HEADER-VALUE", "description": "Bare CR in header value must be rejected or replaced with SP", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Bare CR in header value must be rejected or replaced with SP", "scored": true, "durationMs": 50.8606, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nX-Test: val\rue\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "SMUG-CL-OCTAL", "description": "Content-Length with octal prefix (0o5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Content-Length with octal prefix (0o5) must be rejected", "scored": true, "durationMs": 50.6604, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0o5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-UNDERSCORE", "description": "Chunk size with underscores (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with underscores (1_0) must be rejected", "scored": true, "durationMs": 50.6999, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n1_0\r\nhello world!!!!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nconnection: close\r\nTransfer-Encoding: chunked\r\n\r\n1e\r\nInvalid HTTP request received.\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-EMPTY-VALUE", "description": "Transfer-Encoding with empty value must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding with empty value must be rejected", "scored": true, "durationMs": 50.6741, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-LEADING-COMMA", "description": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding with leading comma (, chunked) \u2014 RFC says empty list elements MUST be ignored", "scored": true, "durationMs": 50.6842, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-DUPLICATE-HEADERS", "description": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Two Transfer-Encoding headers with CL present \u2014 ambiguous framing", "scored": true, "durationMs": 50.5305, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-HEX-PREFIX", "description": "Chunk size with 0x prefix must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size with 0x prefix must be rejected", "scored": true, "durationMs": 50.5334, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n0x5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nconnection: close\r\nTransfer-Encoding: chunked\r\n\r\n1e\r\nInvalid HTTP request received.\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-HEX-PREFIX", "description": "Content-Length with hex prefix (0x5) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Content-Length with hex prefix (0x5) must be rejected", "scored": true, "durationMs": 50.5695, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0x5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-INTERNAL-SPACE", "description": "Content-Length with internal space (1 0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length with internal space (1 0) must be rejected", "scored": true, "durationMs": 50.9582, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1 0\r\n\r\nhello12345", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "SMUG-CHUNK-LEADING-SP", "description": "Chunk size with leading space must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Chunk size with leading space must be rejected", "scored": true, "durationMs": 50.6812, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n 5\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nconnection: close\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-MISSING-TRAILING-CRLF", "description": "Chunk data without trailing CRLF must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Chunk data without trailing CRLF must be rejected", "scored": true, "durationMs": 50.6774, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nconnection: close\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-LF", "description": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Bare LF in chunk extension \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.9612, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nconnection: close\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-SPILL", "description": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Chunk declares size 5 but sends 7 bytes \u2014 oversized chunk data must be rejected", "scored": true, "durationMs": 50.5894, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello!!\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nconnection: close\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TERM", "description": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Bare LF as chunk data terminator \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 50.8065, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nconnection: close\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CTRL", "description": "NUL byte in chunk extension must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 NUL byte in chunk extension must be rejected", "scored": true, "durationMs": 51.0225, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;\u0000ext\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:59 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-EXT-CR", "description": "Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1.1", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Bare CR (not CRLF) in chunk extension \u2014 some parsers treat CR alone as line ending", "scored": true, "durationMs": 51.1376, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;a\rX\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:59 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-VTAB", "description": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Vertical tab before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.9521, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \u000bchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "SMUG-TE-FORMFEED", "description": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Form feed before 'chunked' in TE value \u2014 control char obfuscation vector", "scored": true, "durationMs": 50.9862, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: \fchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "SMUG-TE-NULL", "description": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "NUL byte appended to 'chunked' in TE value \u2014 C-string truncation attack", "scored": true, "durationMs": 50.6127, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\u0000\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-LF-TRAILER", "description": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Bare LF in chunked trailer termination \u2014 server MAY accept bare LF per RFC 9112 \u00a72.2", "scored": true, "durationMs": 51.0549, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:59 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-IDENTITY", "description": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Transfer-Encoding: identity (deprecated) with CL must be rejected", "scored": true, "durationMs": 50.6084, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "SMUG-CHUNK-NEGATIVE", "description": "Negative chunk size must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a77.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Negative chunk size must be rejected", "scored": true, "durationMs": 50.6757, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n-1\r\nhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nconnection: close\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRANSFER_ENCODING", "description": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "category": "Smuggling", "rfc": "RFC 9112 \u00a76.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer_Encoding (underscore) header with CL \u2014 not a valid header but some parsers accept", "scored": false, "durationMs": 50.0967, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:59 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": "Used TE (treated as chunked)"}, {"id": "SMUG-CL-COMMA-SAME", "description": "Content-Length with comma-separated identical values \u2014 some servers merge", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with comma-separated identical values \u2014 some servers merge", "scored": false, "durationMs": 49.9302, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5, 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:59 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNKED-WITH-PARAMS", "description": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "category": "Smuggling", "rfc": "RFC 9112 \u00a77", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding: chunked;ext=val \u2014 parameters on chunked encoding", "scored": true, "durationMs": 50.7447, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-EXPECT-100-CL", "description": "Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "category": "Smuggling", "rfc": "RFC 9110 \u00a710.1.1", "verdict": "Fail", "statusCode": 100, "expected": "400 or 2xx", "got": "100", "connectionState": "Open", "reason": "Expected 400 or 2xx, got 100 \u2014 Expect: 100-continue with Content-Length \u2014 server should send 100 then read body", "scored": false, "durationMs": 50.7851, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\nExpect: 100-continue\r\n\r\nhello", "rawResponse": "HTTP/1.1 100 Continue\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CL", "description": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.848, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Length: 50\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:59 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-TE", "description": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Transfer-Encoding in chunked trailers must be ignored \u2014 prohibited trailer field", "scored": false, "durationMs": 50.8771, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nTransfer-Encoding: chunked\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:48:59 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-HOST", "description": "Host header in chunked trailers must not be used for routing", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Host header in chunked trailers must not be used for routing", "scored": false, "durationMs": 50.9973, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nHost: evil.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:00 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-AUTH", "description": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Authorization header in chunked trailers \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.8673, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nAuthorization: Bearer evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:00 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-HEAD-CL-BODY", "description": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "HEAD request with Content-Length and body \u2014 server must not leave body on connection", "scored": false, "durationMs": 50.787, "rawRequest": "HEAD / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:00 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-OPTIONS-CL-BODY", "description": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "category": "Smuggling", "rfc": "RFC 9110 \u00a79.3.7", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "OPTIONS with Content-Length and body \u2014 server should consume or reject body", "scored": false, "durationMs": 50.556, "rawRequest": "OPTIONS / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:00 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-UNDERSCORE", "description": "Content-Length with underscore digit separator (1_0) must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Content-Length with underscore digit separator (1_0) must be rejected", "scored": true, "durationMs": 50.4388, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 1_0\r\n\r\nhelloworld", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-NEGATIVE-ZERO", "description": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Content-Length: -0 must be rejected \u2014 not valid 1*DIGIT", "scored": true, "durationMs": 50.6022, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: -0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "SMUG-CL-DOUBLE-ZERO", "description": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 00 \u2014 matches 1*DIGIT but leading zero ambiguity", "scored": true, "durationMs": 50.8023, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 00\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:00 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CL-LEADING-ZEROS-OCTAL", "description": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "category": "Smuggling", "rfc": "RFC 9110 \u00a78.6", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length: 0200 \u2014 octal 128 vs decimal 200, parser disagreement vector", "scored": true, "durationMs": 50.8786, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 0200\r\n\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:00 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\nc8\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-OBS-FOLD", "description": "Transfer-Encoding with obs-fold line wrapping must be rejected", "category": "Smuggling", "rfc": "RFC 9112 \u00a75.1", "verdict": "Fail", "statusCode": null, "expected": "400", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400, got TimedOut \u2014 Transfer-Encoding with obs-fold line wrapping must be rejected", "scored": true, "durationMs": 5000.9378, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-TE-TRAILING-COMMA", "description": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.6.1", "verdict": "Pass", "statusCode": 400, "expected": "400 or 2xx", "got": "400", "connectionState": "Open", "reason": "Transfer-Encoding: chunked, \u2014 trailing comma produces empty list element", "scored": true, "durationMs": 50.6344, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TE-TAB-BEFORE-VALUE", "description": "Transfer-Encoding with tab as OWS before value", "category": "Smuggling", "rfc": "RFC 9110 \u00a75.5", "verdict": "Fail", "statusCode": null, "expected": "400 or 2xx", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Expected 400 or 2xx, got TimedOut \u2014 Transfer-Encoding with tab as OWS before value", "scored": false, "durationMs": 5000.6603, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello", "rawResponse": null, "behavioralNote": null}, {"id": "SMUG-ABSOLUTE-URI-HOST-MISMATCH", "description": "Absolute-form URI with different Host header \u2014 routing confusion vector", "category": "Smuggling", "rfc": "RFC 9112 \u00a73.2.2", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Absolute-form URI with different Host header \u2014 routing confusion vector", "scored": false, "durationMs": 50.8371, "rawRequest": "GET http://other.example.com/ HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:10 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-MULTIPLE-HOST-COMMA", "description": "Host header with comma-separated values must be rejected", "category": "Smuggling", "rfc": "RFC 9110 \u00a77.2", "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Host header with comma-separated values must be rejected", "scored": true, "durationMs": 49.6981, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080, other.example.com\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:10 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-CHUNK-BARE-CR-TERM", "description": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "category": "Smuggling", "rfc": "RFC 9112 \u00a72.2", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Chunk size line terminated by bare CR \u2014 not a valid line terminator", "scored": true, "durationMs": 50.6379, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nconnection: close\r\nTransfer-Encoding: chunked\r\n\r\n1e\r\nInvalid HTTP request received.\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "SMUG-TRAILER-CONTENT-TYPE", "description": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "category": "Smuggling", "rfc": "RFC 9110 \u00a76.5.1", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Type in chunked trailer \u2014 prohibited per RFC 9110 \u00a76.5.1", "scored": false, "durationMs": 50.7183, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nContent-Type: text/evil\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:10 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-BINARY-GARBAGE", "description": "Random binary garbage should be rejected or connection closed", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Random binary garbage should be rejected or connection closed", "scored": true, "durationMs": 5000.6595, "rawRequest": ">\u0017???\u0004?;???V???:o?M%U\u0017]?n?\t\u0014W??6??(\u000b??\u0007???p??\u0005\tngk??\rF?'??'\"?????g?\u001a?????rvc??7i??????)??\u0000Q?????\u000eq\u0005-~????>B??u?8???`\u000b?J\u0017>?\u001d?b?\t???T5{\n????\u0006t|????\u0018\u0010?D??\u0015'????dQ%5w\tN K???\r?\u0011????D?\u0003I?(?\u0011??\r?\u001bi?L???\u0005?kg4Ze\f6??\"QT><<`\u0007u\f????=1?jMah\u0012??+?-??J\u001cP??\u001d?7?,???j2\u0014????(", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-URL", "description": "100KB URL should be rejected with 414 URI Too Long", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/414/431 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/414/431 or close, got 200 \u2014 100KB URL should be rejected with 414 URI Too Long", "scored": true, "durationMs": 52.5619, "rawRequest": "GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:15 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-LONG-HEADER-VALUE", "description": "100KB header value should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/431 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400/431 or close, got 200 \u2014 100KB header value should be rejected with 431", "scored": true, "durationMs": 51.9558, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Big: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:15 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-MANY-HEADERS", "description": "10,000 headers should be rejected with 431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "10,000 headers should be rejected with 431", "scored": true, "durationMs": 54.4389, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-H-0: value\r\nX-H-1: value\r\nX-H-2: value\r\nX-H-3: value\r\nX-H-4: value\r\nX-H-5: value\r\nX-H-6: value\r\nX-H-7: value\r\nX-H-8: value\r\nX-H-9: value\r\nX-H-10: value\r\nX-H-11: value\r\nX-H-12: value\r\nX-H-13: value\r\nX-H-14: value\r\nX-H-15: value\r\nX-H-16: value\r\nX-H-17: value\r\nX-H-18: value\r\nX-H-19: value\r\nX-H-20: value\r\nX-H-21: value\r\nX-H-22: value\r\nX-H-23: value\r\nX-H-24: value\r\nX-H-25: value\r\nX-H-26: value\r\nX-H-27: value\r\nX-H-28: value\r\nX-H-29: value\r\nX-H-30: value\r\nX-H-31: value\r\nX-H-32: value\r\nX-H-33: value\r\nX-H-34: value\r\nX-H-35: value\r\nX-H-36: value\r\nX-H-37: value\r\nX-H-38: value\r\nX-H-39: value\r\nX-H-40: value\r\nX-H-41: value\r\nX-H-42: value\r\nX-H-43: value\r\nX-H-44: value\r\nX-H-45: value\r\nX-H-46: value\r\nX-H-47: value\r\nX-H-48: value\r\nX-H-49: value\r\nX-H-50: value\r\nX-H-51: value\r\nX-H-52: value\r\nX-H-53: value\r\nX-H-54: value\r\nX-H-55: value\r\nX-H-56: value\r\nX-H-57: value\r\nX-H-58: value\r\nX-H-59: value\r\nX-H-60: value\r\nX-H-61: value\r\nX-H-62: value\r\nX-H-63: value\r\nX-H-64: value\r\nX-H-65: value\r\nX-H-66: value\r\nX-H-67: value\r\nX-H-68: value\r\nX-H-69: value\r\nX-H-70: value\r\nX-H-71: value\r\nX-H-72: value\r\nX-H-73: value\r\nX-H-74: value\r\nX-H-75: value\r\nX-H-76: value\r\nX-H-77: value\r\nX-H-78: value\r\nX-H-79: value\r\nX-H-80: value\r\nX-H-81: value\r\nX-H-82: value\r\nX-H-83: value\r\nX-H-84: value\r\nX-H-85: value\r\nX-H-86: value\r\nX-H-87: value\r\nX-H-88: value\r\nX-H-89: value\r\nX-H-90: value\r\nX-H-91: value\r\nX-H-92: value\r\nX-H-93: value\r\nX-H-94: value\r\nX-H-95: value\r\nX-H-96: value\r\nX-H-97: value\r\nX-H-98: value\r\nX-H-99: value\r\nX-H-100: value\r\nX-H-101: value\r\nX-H-102: value\r\nX-H-103: value\r\nX-H-104: value\r\nX-H-105: value\r\nX-H-106: value\r\nX-H-107: value\r\nX-H-108: value\r\nX-H-109: value\r\nX-H-110: value\r\nX-H-111: value\r\nX-H-112: value\r\nX-H-113: value\r\nX-H-114: value\r\nX-H-115: value\r\nX-H-116: value\r\nX-H-117: value\r\nX-H-118: value\r\nX-H-119: value\r\nX-H-120: value\r\nX-H-121: value\r\nX-H-122: value\r\nX-H-123: value\r\nX-H-124: value\r\nX-H-125: value\r\nX-H-126: value\r\nX-H-127: value\r\nX-H-128: value\r\nX-H-129: value\r\nX-H-130: value\r\nX-H-131: value\r\nX-H-132: value\r\nX-H-133: value\r\nX-H-134: value\r\nX-H-135: value\r\nX-H-136: value\r\nX-H-137: value\r\nX-H-138: value\r\nX-H-139: value\r\nX-H-140: value\r\nX-H-141: value\r\nX-H-142: value\r\nX-H-143: value\r\nX-H-144: value\r\nX-H-145: value\r\nX-H-146: value\r\nX-H-147: value\r\nX-H-148: value\r\nX-H-149: value\r\nX-H-150: value\r\nX-H-151: value\r\nX-H-152: value\r\nX-H-153: value\r\nX-H-154: value\r\nX-H-155: value\r\nX-H-156: value\r\nX-H-157: value\r\nX-H-158: value\r\nX-H-159: value\r\nX-H-160: value\r\nX-H-161: value\r\nX-H-162: value\r\nX-H-163: value\r\nX-H-164: value\r\nX-H-165: value\r\nX-H-166: value\r\nX-H-167: value\r\nX-H-168: value\r\nX-H-169: value\r\nX-H-170: value\r\nX-H-171: value\r\nX-H-172: value\r\nX-H-173: value\r\nX-H-174: value\r\nX-H-175: value\r\nX-H-176: value\r\nX-H-177: value\r\nX-H-178: value\r\nX-H-179: value\r\nX-H-180: value\r\nX-H-181: value\r\nX-H-182: value\r\nX-H-183: value\r\nX-H-184: value\r\nX-H-185: value\r\nX-H-186: value\r\nX-H-187: value\r\nX-H-188: value\r\nX-H-189: value\r\nX-H-190: value\r\nX-H-191: value\r\nX-H-192: value\r\nX-H-193: value\r\nX-H-194: value\r\nX-H-195: value\r\nX-H-196: value\r\nX-H-197: value\r\nX-H-198: value\r\nX-H-199: value\r\nX-H-200: value\r\nX-H-201: value\r\nX-H-202: value\r\nX-H-203: value\r\nX-H-204: value\r\nX-H-205: value\r\nX-H-206: value\r\nX-H-207: value\r\nX-H-208: value\r\nX-H-209: value\r\nX-H-210: value\r\nX-H-211: value\r\nX-H-212: value\r\nX-H-213: value\r\nX-H-214: value\r\nX-H-215: value\r\nX-H-216: value\r\nX-H-217: value\r\nX-H-218: value\r\nX-H-219: value\r\nX-H-220: value\r\nX-H-221: value\r\nX-H-222: value\r\nX-H-223: value\r\nX-H-224: value\r\nX-H-225: value\r\nX-H-226: value\r\nX-H-227: value\r\nX-H-228: value\r\nX-H-229: value\r\nX-H-230: value\r\nX-H-231: value\r\nX-H-232: value\r\nX-H-233: value\r\nX-H-234: value\r\nX-H-235: value\r\nX-H-236: value\r\nX-H-237: value\r\nX-H-238: value\r\nX-H-239: value\r\nX-H-240: value\r\nX-H-241: value\r\nX-H-242: value\r\nX-H-243: value\r\nX-H-244: value\r\nX-H-245: value\r\nX-H-246: value\r\nX-H-247: value\r\nX-H-248: value\r\nX-H-249: value\r\nX-H-250: value\r\nX-H-251: value\r\nX-H-252: value\r\nX-H-253: value\r\nX-H-254: value\r\nX-H-255: value\r\nX-H-256: value\r\nX-H-257: value\r\nX-H-258: value\r\nX-H-259: value\r\nX-H-260: value\r\nX-H-261: value\r\nX-H-262: value\r\nX-H-263: value\r\nX-H-264: value\r\nX-H-265: value\r\nX-H-266: value\r\nX-H-267: value\r\nX-H-268: value\r\nX-H-269: value\r\nX-H-270: value\r\nX-H-271: value\r\nX-H-272: value\r\nX-H-273: value\r\nX-H-274: value\r\nX-H-275: value\r\nX-H-276: value\r\nX-H-277: value\r\nX-H-278: value\r\nX-H-279: value\r\nX-H-280: value\r\nX-H-281: value\r\nX-H-282: value\r\nX-H-283: value\r\nX-H-284: value\r\nX-H-285: value\r\nX-H-286: value\r\nX-H-287: value\r\nX-H-288: value\r\nX-H-289: value\r\nX-H-290: value\r\nX-H-291: value\r\nX-H-292: value\r\nX-H-293: value\r\nX-H-294: value\r\nX-H-295: value\r\nX-H-296: value\r\nX-H-297: value\r\nX-H-298: value\r\nX-H-299: value\r\nX-H-300: value\r\nX-H-301: value\r\nX-H-302: value\r\nX-H-303: value\r\nX-H-304: value\r\nX-H-305: value\r\nX-H-306: value\r\nX-H-307: value\r\nX-H-308: value\r\nX-H-309: value\r\nX-H-310: value\r\nX-H-311: value\r\nX-H-312: value\r\nX-H-313: value\r\nX-H-314: value\r\nX-H-315: value\r\nX-H-316: value\r\nX-H-317: value\r\nX-H-318: value\r\nX-H-319: value\r\nX-H-320: value\r\nX-H-321: value\r\nX-H-322: value\r\nX-H-323: value\r\nX-H-324: value\r\nX-H-325: value\r\nX-H-326: value\r\nX-H-327: value\r\nX-H-328: value\r\nX-H-329: value\r\nX-H-330: value\r\nX-H-331: value\r\nX-H-332: value\r\nX-H-333: value\r\nX-H-334: value\r\nX-H-335: value\r\nX-H-336: value\r\nX-H-337: value\r\nX-H-338: value\r\nX-H-339: value\r\nX-H-340: value\r\nX-H-341: value\r\nX-H-342: value\r\nX-H-343: value\r\nX-H-344: value\r\nX-H-345: value\r\nX-H-346: value\r\nX-H-347: value\r\nX-H-348: value\r\nX-H-349: value\r\nX-H-350: value\r\nX-H-351: value\r\nX-H-352: value\r\nX-H-353: value\r\nX-H-354: value\r\nX-H-355: value\r\nX-H-356: value\r\nX-H-357: value\r\nX-H-358: value\r\nX-H-359: value\r\nX-H-360: value\r\nX-H-361: value\r\nX-H-362: value\r\nX-H-363: value\r\nX-H-364: value\r\nX-H-365: value\r\nX-H-366: value\r\nX-H-367: value\r\nX-H-368: value\r\nX-H-369: value\r\nX-H-370: value\r\nX-H-371: value\r\nX-H-372: value\r\nX-H-373: value\r\nX-H-374: value\r\nX-H-375: value\r\nX-H-376: value\r\nX-H-377: value\r\nX-H-378: value\r\nX-H-379: value\r\nX-H-380: value\r\nX-H-381: value\r\nX-H-382: value\r\nX-H-383: value\r\nX-H-384: value\r\nX-H-385: value\r\nX-H-386: value\r\nX-H-387: value\r\nX-H-388: value\r\nX-H-389: value\r\nX-H-390: value\r\nX-H-391: value\r\nX-H-392: value\r\nX-H-393: value\r\nX-H-394: value\r\nX-H-395: value\r\nX-H-396: value\r\nX-H-397: value\r\nX-H-398: value\r\nX-H-399: value\r\nX-H-400: value\r\nX-H-401: value\r\nX-H-402: value\r\nX-H-403: value\r\nX-H-404: value\r\nX-H-405: value\r\nX-H-406: value\r\nX-H-407: value\r\nX-H-408: value\r\nX-H-409: value\r\nX-H-410: value\r\nX-H-411: value\r\nX-H-412: value\r\nX-H-413: value\r\nX-H-414: value\r\nX-H-415: value\r\nX-H-416: value\r\nX-H-417: value\r\nX-H-418: value\r\nX-H-419: value\r\nX-H-420: value\r\nX-H-421: value\r\nX-H-422: value\r\nX-H-423: value\r\nX-H-424: value\r\nX-H-425: value\r\nX-H-426: value\r\nX-H-427: value\r\nX-H-428: value\r\nX-H-429: value\r\nX-H-430: value\r\nX-H-431: value\r\nX-H-432: value\r\nX-H-433: value\r\nX-H-434: value\r\nX-H-435: value\r\nX-H-436: value\r\nX-H-437: value\r\nX-H-438: value\r\nX-H-439: value\r\nX-H-440: value\r\nX-H-441: value\r\nX-H-442: value\r\nX-H-443: value\r\nX-H-444: value\r\nX-H-445: value\r\nX-H-446: value\r\nX-H-447: value\r\nX-H-448: value\r\nX-H-449: value\r\nX-H-450: value\r\nX-H-451: value\r\nX-H-452: value\r\nX-H-453: value\r\nX-H-454: value\r\nX-H-455: value\r\nX-H-456: value\r\nX-H-457: value\r\nX-H-458: value\r\nX-H-459: value\r\nX-H-460: value\r\nX-H-461: value\r\nX-H-462: value\r\nX-H-463: value\r\nX-H-464: value\r\nX-H-465: value\r\nX-H-466: value\r\nX-H-467: value\r\nX-H-468: value\r\nX-H-469: value\r\nX-H-470: value\r\nX-H-471: value\r\nX-H-472: value\r\nX-H-473: value\r\nX-H-474: value\r\nX-H-475: value\r\nX-H-476: value\r\nX-H-477: value\r\nX-H-478: value\r\nX-H-479: value\r\nX-H-480: value\r\nX-H-481: value\r\nX-H-482: value\r\nX-H-483: value\r\nX-H-484: value\r\nX-H-485: value\r\nX-H-486: value\r\nX-H-487: value\r\nX-H-488: value\r\nX-H-489: value\r\nX-H-490: value\r\nX-H-491: value\r\nX-H-492: value\r\nX-H-493: value\r\nX-H-494: value\r\nX-H-495: value\r\nX-H-496: value\r\nX-H-497: value\r\nX-H-498: value\r\nX-H-499: value\r\nX-H-500: value\r\nX-H-501: value\r\nX-H-502: value\r\nX-H-503: value\r\nX-H-504: value\r\nX-H-505: value\r\nX-H-506: value\r\nX-H-507: value\r\nX-H-508: value\r\nX-H-509: value\r\nX-H-510: value\r\nX-H-511: value\r\nX-H-512: value\r\nX-H-513: value\r\nX-H-514: value\r\nX-H-515: value\r\nX-H-516:", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "MAL-NUL-IN-URL", "description": "NUL byte in URL should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in URL should be rejected", "scored": true, "durationMs": 50.8348, "rawRequest": "GET /\u0000test HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "MAL-CONTROL-CHARS-HEADER", "description": "Control characters in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400 or close", "got": "200", "connectionState": "Open", "reason": "Expected 400 or close, got 200 \u2014 Control characters in header value should be rejected", "scored": true, "durationMs": 50.7822, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: abc\u0007\b?f\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:15 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-INCOMPLETE-REQUEST", "description": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Partial HTTP request \u2014 request-line and headers but no final CRLF", "scored": true, "durationMs": 5000.3577, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: value", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-EMPTY-REQUEST", "description": "Zero bytes \u2014 TCP connection established without sending any data", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Zero bytes \u2014 TCP connection established without sending any data", "scored": true, "durationMs": 5000.7272, "rawRequest": "", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-LONG-HEADER-NAME", "description": "100KB header name should be rejected with 400/431", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/431 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB header name should be rejected with 400/431", "scored": true, "durationMs": 50.7142, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "MAL-LONG-METHOD", "description": "100KB method name should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "100KB method name should be rejected", "scored": true, "durationMs": 51.2156, "rawRequest": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "MAL-NON-ASCII-HEADER-NAME", "description": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "Open", "reason": "Non-ASCII bytes (UTF-8 \u00eb) in header name must be rejected", "scored": true, "durationMs": 50.626, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-T??st: value\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n", "behavioralNote": null}, {"id": "MAL-NON-ASCII-URL", "description": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Non-ASCII bytes (UTF-8 \u00e9) in URL must be rejected", "scored": true, "durationMs": 50.7771, "rawRequest": "GET /caf?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "MAL-CL-OVERFLOW", "description": "Content-Length with integer overflow value must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Content-Length with integer overflow value must be rejected", "scored": true, "durationMs": 5000.5008, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 99999999999999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-WHITESPACE-ONLY-LINE", "description": "Whitespace-only request line should be rejected or timeout", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400/close/timeout", "got": "400", "connectionState": "ClosedByServer", "reason": "Whitespace-only request line should be rejected or timeout", "scored": true, "durationMs": 51.0287, "rawRequest": " \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "MAL-NUL-IN-HEADER-VALUE", "description": "NUL byte in header value should be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "NUL byte in header value should be rejected", "scored": true, "durationMs": 50.8133, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nX-Test: val\u0000ue\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "MAL-CHUNK-SIZE-OVERFLOW", "description": "Chunk size with integer overflow must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400 or close", "got": "TimedOut", "connectionState": "TimedOut", "reason": "Chunk size with integer overflow must be rejected", "scored": true, "durationMs": 5001.2099, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\nFFFFFFFFFFFFFFFF0\r\nhello\r\n0\r\n\r\n", "rawResponse": null, "behavioralNote": null}, {"id": "MAL-H2-PREFACE", "description": "HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Fail", "statusCode": 200, "expected": "400/505/close/timeout", "got": "200", "connectionState": "Open", "reason": "Expected 400/505/close/timeout, got 200 \u2014 HTTP/2 connection preface sent to HTTP/1.1 server must be rejected", "scored": true, "durationMs": 51.1767, "rawRequest": "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:36 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CL-EMPTY", "description": "Empty Content-Length value must be rejected", "category": "MalformedInput", "rfc": "RFC 9110 \u00a78.6", "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Empty Content-Length value must be rejected", "scored": true, "durationMs": 50.8716, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: \r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "MAL-CL-TAB-BEFORE-VALUE", "description": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "category": "MalformedInput", "rfc": "RFC 9110 \u00a75.5", "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "Content-Length with tab as OWS \u2014 valid per RFC but unusual", "scored": true, "durationMs": 50.4443, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length:\t5\r\n\r\nhello", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:36 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-BACKSLASH", "description": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Backslash in URL path \u2014 not valid URI character, some servers normalize to /", "scored": true, "durationMs": 51.0135, "rawRequest": "GET /path\\file HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:36 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-OVERLONG-UTF8", "description": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": 400, "expected": "400 or close", "got": "400", "connectionState": "ClosedByServer", "reason": "Overlong UTF-8 encoding of / (0xC0 0xAF) in URL must be rejected", "scored": true, "durationMs": 50.9902, "rawRequest": "GET /?? HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 400 Bad Request\r\ncontent-type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\nInvalid HTTP request received.", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-NULL", "description": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded NUL byte (%00) in URL \u2014 security risk from null byte injection", "scored": true, "durationMs": 51.2808, "rawRequest": "GET /path%00.html HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:36 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-URL-PERCENT-CRLF", "description": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx/404", "got": "200", "connectionState": "Open", "reason": "Percent-encoded CRLF (%0d%0a) in URL \u2014 header injection if server decodes during parsing", "scored": true, "durationMs": 51.1843, "rawRequest": "GET /path%0d%0aX-Injected:%20true HTTP/1.1\r\nHost: localhost:8080\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:36 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-CHUNK-EXT-64K", "description": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "400 or 2xx", "got": "200", "connectionState": "Open", "reason": "64KB chunk extension \u2014 tests extension length limits (CVE-2023-39326 class)", "scored": true, "durationMs": 52.5252, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nTransfer-Encoding: chunked\r\n\r\n5;ext=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:36 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-RANGE-OVERLAPPING", "description": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "category": "MalformedInput", "rfc": null, "verdict": "Warn", "statusCode": 200, "expected": "200/206/400/416", "got": "200", "connectionState": "Open", "reason": "1000 overlapping Range values \u2014 resource exhaustion vector (CVE-2011-3192 class)", "scored": false, "durationMs": 52.642, "rawRequest": "GET / HTTP/1.1\r\nHost: localhost:8080\r\nRange: bytes=0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-,0-\r\n\r\n", "rawResponse": "HTTP/1.1 200 OK\r\ndate: Thu, 12 Feb 2026 21:49:36 GMT\r\nserver: uvicorn\r\ncontent-type: text/plain\r\nTransfer-Encoding: chunked\r\n\r\n2\r\nOK\r\n0\r\n\r\n", "behavioralNote": null}, {"id": "MAL-POST-CL-HUGE-NO-BODY", "description": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "category": "MalformedInput", "rfc": null, "verdict": "Pass", "statusCode": null, "expected": "400/close/timeout", "got": "TimedOut", "connectionState": "TimedOut", "reason": "POST with Content-Length: 999999999 but no body \u2014 tests timeout vs memory allocation", "scored": true, "durationMs": 5000.6612, "rawRequest": "POST / HTTP/1.1\r\nHost: localhost:8080\r\nContent-Length: 999999999\r\n\r\n", "rawResponse": null, "behavioralNote": null}], "name": "Uvicorn", "language": "Python"}]}; \ No newline at end of file diff --git a/docs/static/probe/render.js b/docs/static/probe/render.js index 09d38b3..6065474 100644 --- a/docs/static/probe/render.js +++ b/docs/static/probe/render.js @@ -5,7 +5,12 @@ window.ProbeRender = (function () { var FAIL_BG = '#cf222e'; var SKIP_BG = '#656d76'; var EXPECT_BG = '#444c56'; - var pillCss = 'text-align:center;padding:2px 4px;font-size:11px;font-weight:600;color:#fff;border-radius:3px;min-width:28px;display:inline-block;line-height:18px;'; + var pillCss = 'text-align:center;padding:2px 4px;font-size:11px;font-weight:600;color:#fff;border-radius:3px;min-width:28px;display:inline-block;line-height:18px;cursor:default;'; + + function escapeAttr(s) { + if (!s) return ''; + return s.replace(/&/g, '&').replace(/"/g, '"').replace(//g, '>'); + } // Servers temporarily hidden from results (undergoing major changes) var BLACKLISTED_SERVERS = ['GenHTTP']; @@ -44,10 +49,100 @@ window.ProbeRender = (function () { + 'html.dark .probe-table tbody tr{border-bottom-color:#30363d}' + 'html.dark .probe-server-row:hover{background:#161b22}' + 'html.dark .probe-server-row.probe-row-active{background:#2a3a50 !important}' - + 'html.dark .probe-table thead a{color:#58a6ff !important}'; + + 'html.dark .probe-table thead a{color:#58a6ff !important}' + // Tooltip (hover) + + '.probe-tooltip{position:fixed;z-index:9999;background:#1c1c1c;color:#e0e0e0;font-family:monospace;font-size:11px;' + + 'white-space:pre;padding:8px 10px;border-radius:6px;max-width:500px;max-height:300px;overflow:auto;' + + 'pointer-events:none;box-shadow:0 4px 16px rgba(0,0,0,0.3);line-height:1.4}' + + '.probe-tooltip .probe-note{color:#f0c674;font-family:sans-serif;font-weight:600;font-size:11px;margin-bottom:6px;white-space:normal}' + + '.probe-tooltip .probe-label{color:#81a2be;font-family:sans-serif;font-weight:700;font-size:10px;text-transform:uppercase;letter-spacing:0.5px;margin-bottom:2px}' + + '.probe-tooltip .probe-label:not(:first-child){margin-top:8px;padding-top:8px;border-top:1px solid #333}' + // Modal (click) + + '.probe-modal-overlay{position:fixed;inset:0;z-index:10000;background:rgba(0,0,0,0.5);display:flex;align-items:center;justify-content:center}' + + '.probe-modal{background:#1c1c1c;color:#e0e0e0;font-family:monospace;font-size:12px;white-space:pre;' + + 'padding:16px 20px;border-radius:8px;max-width:700px;max-height:80vh;overflow:auto;' + + 'box-shadow:0 8px 32px rgba(0,0,0,0.5);line-height:1.5;position:relative;min-width:300px}' + + '.probe-modal .probe-note{color:#f0c674;font-family:sans-serif;font-weight:600;font-size:13px;margin-bottom:10px;white-space:normal}' + + '.probe-modal .probe-label{color:#81a2be;font-family:sans-serif;font-weight:700;font-size:11px;text-transform:uppercase;letter-spacing:0.5px;margin-bottom:4px}' + + '.probe-modal .probe-label:not(:first-child){margin-top:12px;padding-top:12px;border-top:1px solid #333}' + + '.probe-modal-close{position:sticky;top:0;float:right;background:none;border:none;color:#808080;font-size:20px;' + + 'cursor:pointer;padding:0 4px;line-height:1;font-family:sans-serif}' + + '.probe-modal-close:hover{color:#fff}'; var style = document.createElement('style'); style.textContent = css; document.head.appendChild(style); + + // Tooltip hover handler (delegated) + var tip = null; + document.addEventListener('mouseover', function (e) { + var target = e.target.closest('[data-tooltip]'); + if (!target) return; + if (tip) { tip.remove(); tip = null; } + var text = target.getAttribute('data-tooltip'); + if (!text) return; + tip = document.createElement('div'); + tip.className = 'probe-tooltip'; + var note = target.getAttribute('data-note'); + var req = target.getAttribute('data-request'); + var html = ''; + if (note) html += '
' + escapeAttr(note) + '
'; + if (req) html += '
Request
' + escapeAttr(req); + if (text) html += '
Response
' + escapeAttr(text); + tip.innerHTML = html; + document.body.appendChild(tip); + var rect = target.getBoundingClientRect(); + var tipRect = tip.getBoundingClientRect(); + var left = rect.left + rect.width / 2 - tipRect.width / 2; + if (left < 4) left = 4; + if (left + tipRect.width > window.innerWidth - 4) left = window.innerWidth - 4 - tipRect.width; + var top = rect.top - tipRect.height - 6; + if (top < 4) top = rect.bottom + 6; + tip.style.left = left + 'px'; + tip.style.top = top + 'px'; + }); + document.addEventListener('mouseout', function (e) { + var target = e.target.closest('[data-tooltip]'); + if (target && tip) { tip.remove(); tip = null; } + }); + + // Modal click handler (delegated) + document.addEventListener('click', function (e) { + var target = e.target.closest('[data-tooltip]'); + if (!target) return; + var text = target.getAttribute('data-tooltip'); + var req = target.getAttribute('data-request'); + if (!text && !req) return; + // Dismiss hover tooltip + if (tip) { tip.remove(); tip = null; } + + var note = target.getAttribute('data-note'); + var html = ''; + if (note) html += '
' + escapeAttr(note) + '
'; + if (req) html += '
Request
' + escapeAttr(req); + if (text) html += '
Response
' + escapeAttr(text); + + var overlay = document.createElement('div'); + overlay.className = 'probe-modal-overlay'; + var modal = document.createElement('div'); + modal.className = 'probe-modal'; + modal.innerHTML = html; + overlay.appendChild(modal); + document.body.appendChild(overlay); + + // Close on X button + modal.querySelector('.probe-modal-close').addEventListener('click', function () { + overlay.remove(); + }); + // Close on overlay click (outside modal) + overlay.addEventListener('click', function (ev) { + if (ev.target === overlay) overlay.remove(); + }); + // Close on Escape + function onKey(ev) { + if (ev.key === 'Escape') { overlay.remove(); document.removeEventListener('keydown', onKey); } + } + document.addEventListener('keydown', onKey); + }); } // ── Test ID → doc page URL mapping ───────────────────────────── @@ -197,8 +292,14 @@ window.ProbeRender = (function () { return TEST_URLS[tid] || ''; } - function pill(bg, label) { - return '' + label + ''; + function pill(bg, label, tooltipRaw, tooltipNote, tooltipReq) { + var extra = ''; + var hasData = tooltipRaw || tooltipReq; + if (hasData) extra += ' data-tooltip="' + escapeAttr(tooltipRaw || '') + '"'; + if (tooltipNote) extra += ' data-note="' + escapeAttr(tooltipNote) + '"'; + if (tooltipReq) extra += ' data-request="' + escapeAttr(tooltipReq) + '"'; + var cursor = hasData ? 'cursor:pointer;' : 'cursor:default;'; + return '' + label + ''; } function verdictBg(v) { @@ -396,7 +497,7 @@ window.ProbeRender = (function () { t += '' + pill(SKIP_BG, '\u2014') + ''; return; } - t += '' + pill(verdictBg(r.verdict), r.got) + ''; + t += '' + pill(verdictBg(r.verdict), r.got, r.rawResponse, r.behavioralNote, r.rawRequest) + ''; }); t += ''; }); diff --git a/src/Http11Probe.Cli/Reporting/JsonReporter.cs b/src/Http11Probe.Cli/Reporting/JsonReporter.cs index c17635f..b66c2b8 100644 --- a/src/Http11Probe.Cli/Reporting/JsonReporter.cs +++ b/src/Http11Probe.Cli/Reporting/JsonReporter.cs @@ -41,7 +41,10 @@ public static string Generate(TestRunReport report) statusCode = r.Response?.StatusCode, connectionState = r.ConnectionState.ToString(), error = r.ErrorMessage, - durationMs = r.Duration.TotalMilliseconds + durationMs = r.Duration.TotalMilliseconds, + rawRequest = r.RawRequest, + rawResponse = r.Response?.RawResponse, + behavioralNote = r.BehavioralNote }) }; diff --git a/src/Http11Probe/Response/HttpResponse.cs b/src/Http11Probe/Response/HttpResponse.cs index b98496a..03ad98d 100644 --- a/src/Http11Probe/Response/HttpResponse.cs +++ b/src/Http11Probe/Response/HttpResponse.cs @@ -7,4 +7,6 @@ public sealed class HttpResponse public required string HttpVersion { get; init; } public required IReadOnlyDictionary Headers { get; init; } public bool IsEmpty { get; init; } + public string? RawResponse { get; init; } + public string? Body { get; init; } } diff --git a/src/Http11Probe/Response/ResponseParser.cs b/src/Http11Probe/Response/ResponseParser.cs index 0f12b4f..f302419 100644 --- a/src/Http11Probe/Response/ResponseParser.cs +++ b/src/Http11Probe/Response/ResponseParser.cs @@ -77,13 +77,30 @@ public static class ResponseParser pos = nextLineEnd + 1; } + // Extract body after \r\n\r\n + string? body = null; + var headerEnd = text.IndexOf("\r\n\r\n", StringComparison.Ordinal); + if (headerEnd >= 0) + { + var bodyStart = headerEnd + 4; + if (bodyStart < text.Length) + { + var bodyText = text[bodyStart..]; + body = bodyText.Length > 4096 ? bodyText[..4096] : bodyText; + } + } + + var rawResponse = text.Length > 8192 ? text[..8192] : text; + return new HttpResponse { StatusCode = statusCode, ReasonPhrase = reasonPhrase, HttpVersion = httpVersion, Headers = headers, - IsEmpty = false + IsEmpty = false, + RawResponse = rawResponse, + Body = body }; } } diff --git a/src/Http11Probe/Runner/TestRunner.cs b/src/Http11Probe/Runner/TestRunner.cs index e8ec42b..5d7be0e 100644 --- a/src/Http11Probe/Runner/TestRunner.cs +++ b/src/Http11Probe/Runner/TestRunner.cs @@ -1,4 +1,5 @@ using System.Diagnostics; +using System.Text; using Http11Probe.Client; using Http11Probe.Response; using Http11Probe.TestCases; @@ -78,6 +79,7 @@ private async Task RunSingleAsync(TestCase testCase, TestContext con // Send the primary payload var payload = testCase.PayloadFactory(context); + var rawRequest = Encoding.ASCII.GetString(payload, 0, Math.Min(payload.Length, 8192)); await client.SendAsync(payload); // Read primary response @@ -105,6 +107,7 @@ private async Task RunSingleAsync(TestCase testCase, TestContext con } var verdict = testCase.Expected.Evaluate(response, connectionState); + var behavioralNote = testCase.BehavioralAnalyzer?.Invoke(response); return new TestResult { @@ -113,6 +116,8 @@ private async Task RunSingleAsync(TestCase testCase, TestContext con Response = response, FollowUpResponse = followUpResponse, ConnectionState = connectionState, + BehavioralNote = behavioralNote, + RawRequest = rawRequest, Duration = sw.Elapsed }; } diff --git a/src/Http11Probe/TestCases/Suites/SmugglingSuite.cs b/src/Http11Probe/TestCases/Suites/SmugglingSuite.cs index 91b8538..486a804 100644 --- a/src/Http11Probe/TestCases/Suites/SmugglingSuite.cs +++ b/src/Http11Probe/TestCases/Suites/SmugglingSuite.cs @@ -1,10 +1,56 @@ using System.Text; using Http11Probe.Client; +using Http11Probe.Response; namespace Http11Probe.TestCases.Suites; public static class SmugglingSuite { + // ── Behavioral analyzers ──────────────────────────────────── + // Examine the echoed body to determine which framing the server used. + // Static-config servers (Nginx, Apache, etc.) always return "OK" and cannot echo. + + private const string StaticNote = "Static response — server does not echo POST body"; + + private static bool IsStaticResponse(string body) => body == "OK"; + + private static string? AnalyzeClTeBoth(HttpResponse? r) + { + if (r is null || r.StatusCode is < 200 or >= 300) return null; + var body = (r.Body ?? "").TrimEnd('\r', '\n'); + if (IsStaticResponse(body)) return StaticNote; + if (body.Length == 0) return "Used TE (chunked 0-length → empty body)"; + if (body.Contains("0\r\n\r\n") || body == "0\r\n\r") return "Used CL (read 6 raw bytes including chunk terminator)"; + return $"Body: {Truncate(body)}"; + } + + private static string? AnalyzeDuplicateCl(HttpResponse? r) + { + // Payload: "helloworld" with CL:5 and CL:10 + // CL:5 → "hello", CL:10 → "helloworld" + if (r is null || r.StatusCode is < 200 or >= 300) return null; + var body = (r.Body ?? "").TrimEnd('\r', '\n'); + if (IsStaticResponse(body)) return StaticNote; + if (body == "hello") return "Used first CL (5 bytes)"; + if (body == "helloworld") return "Used second CL (10 bytes)"; + if (body.Length == 0) return "Empty body (server consumed no body)"; + return $"Body: {Truncate(body)}"; + } + + private static string? AnalyzeTeWithClFallback(HttpResponse? r) + { + // Tests with TE variant + CL:5 + body "hello" + // If server used CL → body is "hello"; if TE recognized → empty (chunked parse of "hello") + if (r is null || r.StatusCode is < 200 or >= 300) return null; + var body = (r.Body ?? "").TrimEnd('\r', '\n'); + if (IsStaticResponse(body)) return StaticNote; + if (body == "hello") return "Used CL (ignored TE variant)"; + if (body.Length == 0) return "Used TE (treated as chunked)"; + return $"Body: {Truncate(body)}"; + } + + private static string Truncate(string s) => s.Length > 40 ? s[..40] + "..." : s; + public static IEnumerable GetTestCases() { yield return new TestCase @@ -15,6 +61,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §6.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n"), + BehavioralAnalyzer = AnalyzeClTeBoth, Expected = new ExpectedBehavior { Description = "400 or 2xx", @@ -39,7 +86,8 @@ public static IEnumerable GetTestCases() Category = TestCategory.Smuggling, RfcReference = "RFC 9110 §8.6", PayloadFactory = ctx => MakeRequest( - $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhello"), + $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nContent-Length: 5\r\nContent-Length: 10\r\n\r\nhelloworld"), + BehavioralAnalyzer = AnalyzeDuplicateCl, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -79,6 +127,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §6.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: xchunked\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -94,6 +143,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §6.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: chunked \r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -109,6 +159,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §5", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding : chunked\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -225,6 +276,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §6.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: chunked, chunked\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { Description = "400 or 2xx", @@ -273,6 +325,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §6.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: Chunked\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { Description = "400 or 2xx", @@ -329,6 +382,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §6.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.0\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -407,6 +461,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §6.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: \r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -422,6 +477,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9110 §5.6.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: , chunked\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { Description = "400 or 2xx", @@ -447,6 +503,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §6.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -670,6 +727,7 @@ public static IEnumerable GetTestCases() after.CopyTo(payload, before.Length + vtab.Length); return payload; }, + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -694,6 +752,7 @@ public static IEnumerable GetTestCases() after.CopyTo(payload, before.Length + ff.Length); return payload; }, + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -718,6 +777,7 @@ public static IEnumerable GetTestCases() after.CopyTo(payload, before.Length + nul.Length); return payload; }, + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -762,6 +822,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §7", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: identity\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400), @@ -795,6 +856,7 @@ public static IEnumerable GetTestCases() Scored = false, PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer_Encoding: chunked\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { Description = "400 or 2xx", @@ -844,6 +906,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §7", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: chunked;ext=val\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { Description = "400 or 2xx", @@ -1129,6 +1192,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9112 §5.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding:\r\n chunked\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { ExpectedStatus = StatusCodeRange.Exact(400) @@ -1143,6 +1207,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9110 §5.6.1", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding: chunked,\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { Description = "400 or 2xx", @@ -1168,6 +1233,7 @@ public static IEnumerable GetTestCases() RfcReference = "RFC 9110 §5.5", PayloadFactory = ctx => MakeRequest( $"POST / HTTP/1.1\r\nHost: {ctx.HostHeader}\r\nTransfer-Encoding:\tchunked\r\nContent-Length: 5\r\n\r\nhello"), + BehavioralAnalyzer = AnalyzeTeWithClFallback, Expected = new ExpectedBehavior { Description = "400 or 2xx", diff --git a/src/Http11Probe/TestCases/TestCase.cs b/src/Http11Probe/TestCases/TestCase.cs index 586a7e2..72e590c 100644 --- a/src/Http11Probe/TestCases/TestCase.cs +++ b/src/Http11Probe/TestCases/TestCase.cs @@ -1,3 +1,5 @@ +using Http11Probe.Response; + namespace Http11Probe.TestCases; public sealed class TestCase @@ -11,4 +13,5 @@ public sealed class TestCase public required ExpectedBehavior Expected { get; init; } public bool RequiresConnectionReuse { get; init; } public bool Scored { get; init; } = true; + public Func? BehavioralAnalyzer { get; init; } } diff --git a/src/Http11Probe/TestCases/TestResult.cs b/src/Http11Probe/TestCases/TestResult.cs index 61f710f..79e1bcc 100644 --- a/src/Http11Probe/TestCases/TestResult.cs +++ b/src/Http11Probe/TestCases/TestResult.cs @@ -11,5 +11,7 @@ public sealed class TestResult public HttpResponse? FollowUpResponse { get; init; } public ConnectionState ConnectionState { get; init; } public string? ErrorMessage { get; init; } + public string? BehavioralNote { get; init; } + public string? RawRequest { get; init; } public TimeSpan Duration { get; init; } } diff --git a/src/Servers/ActixServer/src/main.rs b/src/Servers/ActixServer/src/main.rs index e6cde26..793a81f 100644 --- a/src/Servers/ActixServer/src/main.rs +++ b/src/Servers/ActixServer/src/main.rs @@ -1,9 +1,15 @@ -use actix_web::{web, App, HttpServer, HttpResponse}; +use actix_web::{web, App, HttpServer, HttpRequest, HttpResponse}; -async fn ok() -> HttpResponse { - HttpResponse::Ok() - .content_type("text/plain") - .body("OK") +async fn handler(req: HttpRequest, body: web::Bytes) -> HttpResponse { + if req.method() == actix_web::http::Method::POST { + HttpResponse::Ok() + .content_type("text/plain") + .body(body) + } else { + HttpResponse::Ok() + .content_type("text/plain") + .body("OK") + } } #[actix_web::main] @@ -14,7 +20,7 @@ async fn main() -> std::io::Result<()> { .unwrap_or(8080); HttpServer::new(|| { - App::new().default_service(web::to(ok)) + App::new().default_service(web::to(handler)) }) .bind(("0.0.0.0", port))? .run() diff --git a/src/Servers/AspNetMinimal/Program.cs b/src/Servers/AspNetMinimal/Program.cs index 283d58d..022b93b 100644 --- a/src/Servers/AspNetMinimal/Program.cs +++ b/src/Servers/AspNetMinimal/Program.cs @@ -6,6 +6,11 @@ app.MapGet("/", () => "OK"); -app.MapPost("/", () => "OK"); +app.MapPost("/", async (HttpContext ctx) => +{ + using var reader = new StreamReader(ctx.Request.Body); + var body = await reader.ReadToEndAsync(); + return Results.Text(body); +}); app.Run(); diff --git a/src/Servers/BunServer/server.ts b/src/Servers/BunServer/server.ts index 7ffd53a..8cd288e 100644 --- a/src/Servers/BunServer/server.ts +++ b/src/Servers/BunServer/server.ts @@ -3,7 +3,11 @@ const port = parseInt(Bun.argv[2] || "8080", 10); Bun.serve({ port, hostname: "0.0.0.0", - fetch() { + async fetch(req) { + if (req.method === "POST") { + const body = await req.text(); + return new Response(body); + } return new Response("OK"); }, }); diff --git a/src/Servers/DenoServer/server.ts b/src/Servers/DenoServer/server.ts index 3fe61c5..58efb4c 100644 --- a/src/Servers/DenoServer/server.ts +++ b/src/Servers/DenoServer/server.ts @@ -1,3 +1,7 @@ -Deno.serve({ port: 8080, hostname: "0.0.0.0" }, () => { +Deno.serve({ port: 8080, hostname: "0.0.0.0" }, async (req) => { + if (req.method === "POST") { + const body = await req.text(); + return new Response(body, { headers: { "content-type": "text/plain" } }); + } return new Response("OK", { headers: { "content-type": "text/plain" } }); }); diff --git a/src/Servers/EmbedIOServer/Program.cs b/src/Servers/EmbedIOServer/Program.cs index 2606417..77e31c8 100644 --- a/src/Servers/EmbedIOServer/Program.cs +++ b/src/Servers/EmbedIOServer/Program.cs @@ -7,10 +7,19 @@ using var server = new WebServer(o => o .WithUrlPrefix(url) .WithMode(HttpListenerMode.EmbedIO)) - .WithModule(new ActionModule("/", HttpVerbs.Any, ctx => + .WithModule(new ActionModule("/", HttpVerbs.Any, async ctx => { ctx.Response.ContentType = "text/plain"; - return ctx.SendStringAsync("OK", "text/plain", System.Text.Encoding.UTF8); + if (ctx.Request.HttpVerb == HttpVerbs.Post) + { + using var reader = new System.IO.StreamReader(ctx.Request.InputStream); + var body = await reader.ReadToEndAsync(); + await ctx.SendStringAsync(body, "text/plain", System.Text.Encoding.UTF8); + } + else + { + await ctx.SendStringAsync("OK", "text/plain", System.Text.Encoding.UTF8); + } })); Console.WriteLine($"EmbedIO listening on http://localhost:{port}"); diff --git a/src/Servers/ExpressServer/node_modules/.bin/mime b/src/Servers/ExpressServer/node_modules/.bin/mime new file mode 120000 index 0000000..fbb7ee0 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/.bin/mime @@ -0,0 +1 @@ +../mime/cli.js \ No newline at end of file diff --git a/src/Servers/ExpressServer/node_modules/.package-lock.json b/src/Servers/ExpressServer/node_modules/.package-lock.json new file mode 100644 index 0000000..e5bcf5f --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/.package-lock.json @@ -0,0 +1,751 @@ +{ + "name": "express-server", + "lockfileVersion": 3, + "requires": true, + "packages": { + "node_modules/accepts": { + "version": "1.3.8", + "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz", + "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==", + "dependencies": { + "mime-types": "~2.1.34", + "negotiator": "0.6.3" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/array-flatten": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz", + "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==" + }, + "node_modules/body-parser": { + "version": "1.20.4", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.4.tgz", + "integrity": "sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==", + "dependencies": { + "bytes": "~3.1.2", + "content-type": "~1.0.5", + "debug": "2.6.9", + "depd": "2.0.0", + "destroy": "~1.2.0", + "http-errors": "~2.0.1", + "iconv-lite": "~0.4.24", + "on-finished": "~2.4.1", + "qs": "~6.14.0", + "raw-body": "~2.5.3", + "type-is": "~1.6.18", + "unpipe": "~1.0.0" + }, + "engines": { + "node": ">= 0.8", + "npm": "1.2.8000 || >= 1.4.16" + } + }, + "node_modules/bytes": { + "version": "3.1.2", + "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", + "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/call-bind-apply-helpers": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz", + "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==", + "dependencies": { + "es-errors": "^1.3.0", + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/call-bound": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz", + "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==", + "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "get-intrinsic": "^1.3.0" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/content-disposition": { + "version": "0.5.4", + "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz", + "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==", + "dependencies": { + "safe-buffer": "5.2.1" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/content-type": { + "version": "1.0.5", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz", + "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/cookie": { + "version": "0.7.2", + "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz", + "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/cookie-signature": { + "version": "1.0.7", + "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz", + "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==" + }, + "node_modules/debug": { + "version": "2.6.9", + "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz", + "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==", + "dependencies": { + "ms": "2.0.0" + } + }, + "node_modules/depd": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz", + "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/destroy": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz", + "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==", + "engines": { + "node": ">= 0.8", + "npm": "1.2.8000 || >= 1.4.16" + } + }, + "node_modules/dunder-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", + "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==", + "dependencies": { + "call-bind-apply-helpers": "^1.0.1", + "es-errors": "^1.3.0", + "gopd": "^1.2.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/ee-first": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz", + "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==" + }, + "node_modules/encodeurl": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz", + "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/es-define-property": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz", + "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-errors": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", + "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-object-atoms": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz", + "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==", + "dependencies": { + "es-errors": "^1.3.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/escape-html": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz", + "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==" + }, + "node_modules/etag": { + "version": "1.8.1", + "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz", + "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/express": { + "version": "4.22.1", + "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz", + "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==", + "dependencies": { + "accepts": "~1.3.8", + "array-flatten": "1.1.1", + "body-parser": "~1.20.3", + "content-disposition": "~0.5.4", + "content-type": "~1.0.4", + "cookie": "~0.7.1", + "cookie-signature": "~1.0.6", + "debug": "2.6.9", + "depd": "2.0.0", + "encodeurl": "~2.0.0", + "escape-html": "~1.0.3", + "etag": "~1.8.1", + "finalhandler": "~1.3.1", + "fresh": "~0.5.2", + "http-errors": "~2.0.0", + "merge-descriptors": "1.0.3", + "methods": "~1.1.2", + "on-finished": "~2.4.1", + "parseurl": "~1.3.3", + "path-to-regexp": "~0.1.12", + "proxy-addr": "~2.0.7", + "qs": "~6.14.0", + "range-parser": "~1.2.1", + "safe-buffer": "5.2.1", + "send": "~0.19.0", + "serve-static": "~1.16.2", + "setprototypeof": "1.2.0", + "statuses": "~2.0.1", + "type-is": "~1.6.18", + "utils-merge": "1.0.1", + "vary": "~1.1.2" + }, + "engines": { + "node": ">= 0.10.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/finalhandler": { + "version": "1.3.2", + "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz", + "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==", + "dependencies": { + "debug": "2.6.9", + "encodeurl": "~2.0.0", + "escape-html": "~1.0.3", + "on-finished": "~2.4.1", + "parseurl": "~1.3.3", + "statuses": "~2.0.2", + "unpipe": "~1.0.0" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/forwarded": { + "version": "0.2.0", + "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz", + "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/fresh": { + "version": "0.5.2", + "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz", + "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/function-bind": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", + "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-intrinsic": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz", + "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==", + "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "es-define-property": "^1.0.1", + "es-errors": "^1.3.0", + "es-object-atoms": "^1.1.1", + "function-bind": "^1.1.2", + "get-proto": "^1.0.1", + "gopd": "^1.2.0", + "has-symbols": "^1.1.0", + "hasown": "^2.0.2", + "math-intrinsics": "^1.1.0" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/get-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz", + "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==", + "dependencies": { + "dunder-proto": "^1.0.1", + "es-object-atoms": "^1.0.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/gopd": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz", + "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/has-symbols": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz", + "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/hasown": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz", + "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==", + "dependencies": { + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/http-errors": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", + "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==", + "dependencies": { + "depd": "~2.0.0", + "inherits": "~2.0.4", + "setprototypeof": "~1.2.0", + "statuses": "~2.0.2", + "toidentifier": "~1.0.1" + }, + "engines": { + "node": ">= 0.8" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/iconv-lite": { + "version": "0.4.24", + "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz", + "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==", + "dependencies": { + "safer-buffer": ">= 2.1.2 < 3" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/inherits": { + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==" + }, + "node_modules/ipaddr.js": { + "version": "1.9.1", + "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz", + "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==", + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/math-intrinsics": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz", + "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/media-typer": { + "version": "0.3.0", + "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz", + "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/merge-descriptors": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz", + "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==", + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/methods": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz", + "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/mime": { + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz", + "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==", + "bin": { + "mime": "cli.js" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/mime-db": { + "version": "1.52.0", + "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz", + "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/mime-types": { + "version": "2.1.35", + "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz", + "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==", + "dependencies": { + "mime-db": "1.52.0" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/ms": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz", + "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==" + }, + "node_modules/negotiator": { + "version": "0.6.3", + "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz", + "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/object-inspect": { + "version": "1.13.4", + "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz", + "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==", + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/on-finished": { + "version": "2.4.1", + "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz", + "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==", + "dependencies": { + "ee-first": "1.1.1" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/parseurl": { + "version": "1.3.3", + "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz", + "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/path-to-regexp": { + "version": "0.1.12", + "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz", + "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==" + }, + "node_modules/proxy-addr": { + "version": "2.0.7", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", + "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "dependencies": { + "forwarded": "0.2.0", + "ipaddr.js": "1.9.1" + }, + "engines": { + "node": ">= 0.10" + } + }, + "node_modules/qs": { + "version": "6.14.2", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz", + "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==", + "dependencies": { + "side-channel": "^1.1.0" + }, + "engines": { + "node": ">=0.6" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/range-parser": { + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz", + "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==", + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/raw-body": { + "version": "2.5.3", + "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz", + "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==", + "dependencies": { + "bytes": "~3.1.2", + "http-errors": "~2.0.1", + "iconv-lite": "~0.4.24", + "unpipe": "~1.0.0" + }, + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/safe-buffer": { + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", + "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/feross" + }, + { + "type": "patreon", + "url": "https://www.patreon.com/feross" + }, + { + "type": "consulting", + "url": "https://feross.org/support" + } + ] + }, + "node_modules/safer-buffer": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz", + "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==" + }, + "node_modules/send": { + "version": "0.19.2", + "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz", + "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==", + "dependencies": { + "debug": "2.6.9", + "depd": "2.0.0", + "destroy": "1.2.0", + "encodeurl": "~2.0.0", + "escape-html": "~1.0.3", + "etag": "~1.8.1", + "fresh": "~0.5.2", + "http-errors": "~2.0.1", + "mime": "1.6.0", + "ms": "2.1.3", + "on-finished": "~2.4.1", + "range-parser": "~1.2.1", + "statuses": "~2.0.2" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/send/node_modules/ms": { + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==" + }, + "node_modules/serve-static": { + "version": "1.16.3", + "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz", + "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==", + "dependencies": { + "encodeurl": "~2.0.0", + "escape-html": "~1.0.3", + "parseurl": "~1.3.3", + "send": "~0.19.1" + }, + "engines": { + "node": ">= 0.8.0" + } + }, + "node_modules/setprototypeof": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz", + "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==" + }, + "node_modules/side-channel": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz", + "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==", + "dependencies": { + "es-errors": "^1.3.0", + "object-inspect": "^1.13.3", + "side-channel-list": "^1.0.0", + "side-channel-map": "^1.0.1", + "side-channel-weakmap": "^1.0.2" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel-list": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz", + "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==", + "dependencies": { + "es-errors": "^1.3.0", + "object-inspect": "^1.13.3" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel-map": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz", + "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==", + "dependencies": { + "call-bound": "^1.0.2", + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.5", + "object-inspect": "^1.13.3" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel-weakmap": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz", + "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==", + "dependencies": { + "call-bound": "^1.0.2", + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.5", + "object-inspect": "^1.13.3", + "side-channel-map": "^1.0.1" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/statuses": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz", + "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/toidentifier": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz", + "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==", + "engines": { + "node": ">=0.6" + } + }, + "node_modules/type-is": { + "version": "1.6.18", + "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz", + "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==", + "dependencies": { + "media-typer": "0.3.0", + "mime-types": "~2.1.24" + }, + "engines": { + "node": ">= 0.6" + } + }, + "node_modules/unpipe": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz", + "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==", + "engines": { + "node": ">= 0.8" + } + }, + "node_modules/utils-merge": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz", + "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==", + "engines": { + "node": ">= 0.4.0" + } + }, + "node_modules/vary": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz", + "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==", + "engines": { + "node": ">= 0.8" + } + } + } +} diff --git a/src/Servers/ExpressServer/node_modules/accepts/HISTORY.md b/src/Servers/ExpressServer/node_modules/accepts/HISTORY.md new file mode 100644 index 0000000..cb5990c --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/accepts/HISTORY.md @@ -0,0 +1,243 @@ +1.3.8 / 2022-02-02 +================== + + * deps: mime-types@~2.1.34 + - deps: mime-db@~1.51.0 + * deps: negotiator@0.6.3 + +1.3.7 / 2019-04-29 +================== + + * deps: negotiator@0.6.2 + - Fix sorting charset, encoding, and language with extra parameters + +1.3.6 / 2019-04-28 +================== + + * deps: mime-types@~2.1.24 + - deps: mime-db@~1.40.0 + +1.3.5 / 2018-02-28 +================== + + * deps: mime-types@~2.1.18 + - deps: mime-db@~1.33.0 + +1.3.4 / 2017-08-22 +================== + + * deps: mime-types@~2.1.16 + - deps: mime-db@~1.29.0 + +1.3.3 / 2016-05-02 +================== + + * deps: mime-types@~2.1.11 + - deps: mime-db@~1.23.0 + * deps: negotiator@0.6.1 + - perf: improve `Accept` parsing speed + - perf: improve `Accept-Charset` parsing speed + - perf: improve `Accept-Encoding` parsing speed + - perf: improve `Accept-Language` parsing speed + +1.3.2 / 2016-03-08 +================== + + * deps: mime-types@~2.1.10 + - Fix extension of `application/dash+xml` + - Update primary extension for `audio/mp4` + - deps: mime-db@~1.22.0 + +1.3.1 / 2016-01-19 +================== + + * deps: mime-types@~2.1.9 + - deps: mime-db@~1.21.0 + +1.3.0 / 2015-09-29 +================== + + * deps: mime-types@~2.1.7 + - deps: mime-db@~1.19.0 + * deps: negotiator@0.6.0 + - Fix including type extensions in parameters in `Accept` parsing + - Fix parsing `Accept` parameters with quoted equals + - Fix parsing `Accept` parameters with quoted semicolons + - Lazy-load modules from main entry point + - perf: delay type concatenation until needed + - perf: enable strict mode + - perf: hoist regular expressions + - perf: remove closures getting spec properties + - perf: remove a closure from media type parsing + - perf: remove property delete from media type parsing + +1.2.13 / 2015-09-06 +=================== + + * deps: mime-types@~2.1.6 + - deps: mime-db@~1.18.0 + +1.2.12 / 2015-07-30 +=================== + + * deps: mime-types@~2.1.4 + - deps: mime-db@~1.16.0 + +1.2.11 / 2015-07-16 +=================== + + * deps: mime-types@~2.1.3 + - deps: mime-db@~1.15.0 + +1.2.10 / 2015-07-01 +=================== + + * deps: mime-types@~2.1.2 + - deps: mime-db@~1.14.0 + +1.2.9 / 2015-06-08 +================== + + * deps: mime-types@~2.1.1 + - perf: fix deopt during mapping + +1.2.8 / 2015-06-07 +================== + + * deps: mime-types@~2.1.0 + - deps: mime-db@~1.13.0 + * perf: avoid argument reassignment & argument slice + * perf: avoid negotiator recursive construction + * perf: enable strict mode + * perf: remove unnecessary bitwise operator + +1.2.7 / 2015-05-10 +================== + + * deps: negotiator@0.5.3 + - Fix media type parameter matching to be case-insensitive + +1.2.6 / 2015-05-07 +================== + + * deps: mime-types@~2.0.11 + - deps: mime-db@~1.9.1 + * deps: negotiator@0.5.2 + - Fix comparing media types with quoted values + - Fix splitting media types with quoted commas + +1.2.5 / 2015-03-13 +================== + + * deps: mime-types@~2.0.10 + - deps: mime-db@~1.8.0 + +1.2.4 / 2015-02-14 +================== + + * Support Node.js 0.6 + * deps: mime-types@~2.0.9 + - deps: mime-db@~1.7.0 + * deps: negotiator@0.5.1 + - Fix preference sorting to be stable for long acceptable lists + +1.2.3 / 2015-01-31 +================== + + * deps: mime-types@~2.0.8 + - deps: mime-db@~1.6.0 + +1.2.2 / 2014-12-30 +================== + + * deps: mime-types@~2.0.7 + - deps: mime-db@~1.5.0 + +1.2.1 / 2014-12-30 +================== + + * deps: mime-types@~2.0.5 + - deps: mime-db@~1.3.1 + +1.2.0 / 2014-12-19 +================== + + * deps: negotiator@0.5.0 + - Fix list return order when large accepted list + - Fix missing identity encoding when q=0 exists + - Remove dynamic building of Negotiator class + +1.1.4 / 2014-12-10 +================== + + * deps: mime-types@~2.0.4 + - deps: mime-db@~1.3.0 + +1.1.3 / 2014-11-09 +================== + + * deps: mime-types@~2.0.3 + - deps: mime-db@~1.2.0 + +1.1.2 / 2014-10-14 +================== + + * deps: negotiator@0.4.9 + - Fix error when media type has invalid parameter + +1.1.1 / 2014-09-28 +================== + + * deps: mime-types@~2.0.2 + - deps: mime-db@~1.1.0 + * deps: negotiator@0.4.8 + - Fix all negotiations to be case-insensitive + - Stable sort preferences of same quality according to client order + +1.1.0 / 2014-09-02 +================== + + * update `mime-types` + +1.0.7 / 2014-07-04 +================== + + * Fix wrong type returned from `type` when match after unknown extension + +1.0.6 / 2014-06-24 +================== + + * deps: negotiator@0.4.7 + +1.0.5 / 2014-06-20 +================== + + * fix crash when unknown extension given + +1.0.4 / 2014-06-19 +================== + + * use `mime-types` + +1.0.3 / 2014-06-11 +================== + + * deps: negotiator@0.4.6 + - Order by specificity when quality is the same + +1.0.2 / 2014-05-29 +================== + + * Fix interpretation when header not in request + * deps: pin negotiator@0.4.5 + +1.0.1 / 2014-01-18 +================== + + * Identity encoding isn't always acceptable + * deps: negotiator@~0.4.0 + +1.0.0 / 2013-12-27 +================== + + * Genesis diff --git a/src/Servers/ExpressServer/node_modules/accepts/LICENSE b/src/Servers/ExpressServer/node_modules/accepts/LICENSE new file mode 100644 index 0000000..0616607 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/accepts/LICENSE @@ -0,0 +1,23 @@ +(The MIT License) + +Copyright (c) 2014 Jonathan Ong +Copyright (c) 2015 Douglas Christopher Wilson + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +'Software'), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/src/Servers/ExpressServer/node_modules/accepts/README.md b/src/Servers/ExpressServer/node_modules/accepts/README.md new file mode 100644 index 0000000..82680c5 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/accepts/README.md @@ -0,0 +1,140 @@ +# accepts + +[![NPM Version][npm-version-image]][npm-url] +[![NPM Downloads][npm-downloads-image]][npm-url] +[![Node.js Version][node-version-image]][node-version-url] +[![Build Status][github-actions-ci-image]][github-actions-ci-url] +[![Test Coverage][coveralls-image]][coveralls-url] + +Higher level content negotiation based on [negotiator](https://www.npmjs.com/package/negotiator). +Extracted from [koa](https://www.npmjs.com/package/koa) for general use. + +In addition to negotiator, it allows: + +- Allows types as an array or arguments list, ie `(['text/html', 'application/json'])` + as well as `('text/html', 'application/json')`. +- Allows type shorthands such as `json`. +- Returns `false` when no types match +- Treats non-existent headers as `*` + +## Installation + +This is a [Node.js](https://nodejs.org/en/) module available through the +[npm registry](https://www.npmjs.com/). Installation is done using the +[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally): + +```sh +$ npm install accepts +``` + +## API + +```js +var accepts = require('accepts') +``` + +### accepts(req) + +Create a new `Accepts` object for the given `req`. + +#### .charset(charsets) + +Return the first accepted charset. If nothing in `charsets` is accepted, +then `false` is returned. + +#### .charsets() + +Return the charsets that the request accepts, in the order of the client's +preference (most preferred first). + +#### .encoding(encodings) + +Return the first accepted encoding. If nothing in `encodings` is accepted, +then `false` is returned. + +#### .encodings() + +Return the encodings that the request accepts, in the order of the client's +preference (most preferred first). + +#### .language(languages) + +Return the first accepted language. If nothing in `languages` is accepted, +then `false` is returned. + +#### .languages() + +Return the languages that the request accepts, in the order of the client's +preference (most preferred first). + +#### .type(types) + +Return the first accepted type (and it is returned as the same text as what +appears in the `types` array). If nothing in `types` is accepted, then `false` +is returned. + +The `types` array can contain full MIME types or file extensions. Any value +that is not a full MIME types is passed to `require('mime-types').lookup`. + +#### .types() + +Return the types that the request accepts, in the order of the client's +preference (most preferred first). + +## Examples + +### Simple type negotiation + +This simple example shows how to use `accepts` to return a different typed +respond body based on what the client wants to accept. The server lists it's +preferences in order and will get back the best match between the client and +server. + +```js +var accepts = require('accepts') +var http = require('http') + +function app (req, res) { + var accept = accepts(req) + + // the order of this list is significant; should be server preferred order + switch (accept.type(['json', 'html'])) { + case 'json': + res.setHeader('Content-Type', 'application/json') + res.write('{"hello":"world!"}') + break + case 'html': + res.setHeader('Content-Type', 'text/html') + res.write('hello, world!') + break + default: + // the fallback is text/plain, so no need to specify it above + res.setHeader('Content-Type', 'text/plain') + res.write('hello, world!') + break + } + + res.end() +} + +http.createServer(app).listen(3000) +``` + +You can test this out with the cURL program: +```sh +curl -I -H'Accept: text/html' http://localhost:3000/ +``` + +## License + +[MIT](LICENSE) + +[coveralls-image]: https://badgen.net/coveralls/c/github/jshttp/accepts/master +[coveralls-url]: https://coveralls.io/r/jshttp/accepts?branch=master +[github-actions-ci-image]: https://badgen.net/github/checks/jshttp/accepts/master?label=ci +[github-actions-ci-url]: https://github.com/jshttp/accepts/actions/workflows/ci.yml +[node-version-image]: https://badgen.net/npm/node/accepts +[node-version-url]: https://nodejs.org/en/download +[npm-downloads-image]: https://badgen.net/npm/dm/accepts +[npm-url]: https://npmjs.org/package/accepts +[npm-version-image]: https://badgen.net/npm/v/accepts diff --git a/src/Servers/ExpressServer/node_modules/accepts/index.js b/src/Servers/ExpressServer/node_modules/accepts/index.js new file mode 100644 index 0000000..e9b2f63 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/accepts/index.js @@ -0,0 +1,238 @@ +/*! + * accepts + * Copyright(c) 2014 Jonathan Ong + * Copyright(c) 2015 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + * @private + */ + +var Negotiator = require('negotiator') +var mime = require('mime-types') + +/** + * Module exports. + * @public + */ + +module.exports = Accepts + +/** + * Create a new Accepts object for the given req. + * + * @param {object} req + * @public + */ + +function Accepts (req) { + if (!(this instanceof Accepts)) { + return new Accepts(req) + } + + this.headers = req.headers + this.negotiator = new Negotiator(req) +} + +/** + * Check if the given `type(s)` is acceptable, returning + * the best match when true, otherwise `undefined`, in which + * case you should respond with 406 "Not Acceptable". + * + * The `type` value may be a single mime type string + * such as "application/json", the extension name + * such as "json" or an array `["json", "html", "text/plain"]`. When a list + * or array is given the _best_ match, if any is returned. + * + * Examples: + * + * // Accept: text/html + * this.types('html'); + * // => "html" + * + * // Accept: text/*, application/json + * this.types('html'); + * // => "html" + * this.types('text/html'); + * // => "text/html" + * this.types('json', 'text'); + * // => "json" + * this.types('application/json'); + * // => "application/json" + * + * // Accept: text/*, application/json + * this.types('image/png'); + * this.types('png'); + * // => undefined + * + * // Accept: text/*;q=.5, application/json + * this.types(['html', 'json']); + * this.types('html', 'json'); + * // => "json" + * + * @param {String|Array} types... + * @return {String|Array|Boolean} + * @public + */ + +Accepts.prototype.type = +Accepts.prototype.types = function (types_) { + var types = types_ + + // support flattened arguments + if (types && !Array.isArray(types)) { + types = new Array(arguments.length) + for (var i = 0; i < types.length; i++) { + types[i] = arguments[i] + } + } + + // no types, return all requested types + if (!types || types.length === 0) { + return this.negotiator.mediaTypes() + } + + // no accept header, return first given type + if (!this.headers.accept) { + return types[0] + } + + var mimes = types.map(extToMime) + var accepts = this.negotiator.mediaTypes(mimes.filter(validMime)) + var first = accepts[0] + + return first + ? types[mimes.indexOf(first)] + : false +} + +/** + * Return accepted encodings or best fit based on `encodings`. + * + * Given `Accept-Encoding: gzip, deflate` + * an array sorted by quality is returned: + * + * ['gzip', 'deflate'] + * + * @param {String|Array} encodings... + * @return {String|Array} + * @public + */ + +Accepts.prototype.encoding = +Accepts.prototype.encodings = function (encodings_) { + var encodings = encodings_ + + // support flattened arguments + if (encodings && !Array.isArray(encodings)) { + encodings = new Array(arguments.length) + for (var i = 0; i < encodings.length; i++) { + encodings[i] = arguments[i] + } + } + + // no encodings, return all requested encodings + if (!encodings || encodings.length === 0) { + return this.negotiator.encodings() + } + + return this.negotiator.encodings(encodings)[0] || false +} + +/** + * Return accepted charsets or best fit based on `charsets`. + * + * Given `Accept-Charset: utf-8, iso-8859-1;q=0.2, utf-7;q=0.5` + * an array sorted by quality is returned: + * + * ['utf-8', 'utf-7', 'iso-8859-1'] + * + * @param {String|Array} charsets... + * @return {String|Array} + * @public + */ + +Accepts.prototype.charset = +Accepts.prototype.charsets = function (charsets_) { + var charsets = charsets_ + + // support flattened arguments + if (charsets && !Array.isArray(charsets)) { + charsets = new Array(arguments.length) + for (var i = 0; i < charsets.length; i++) { + charsets[i] = arguments[i] + } + } + + // no charsets, return all requested charsets + if (!charsets || charsets.length === 0) { + return this.negotiator.charsets() + } + + return this.negotiator.charsets(charsets)[0] || false +} + +/** + * Return accepted languages or best fit based on `langs`. + * + * Given `Accept-Language: en;q=0.8, es, pt` + * an array sorted by quality is returned: + * + * ['es', 'pt', 'en'] + * + * @param {String|Array} langs... + * @return {Array|String} + * @public + */ + +Accepts.prototype.lang = +Accepts.prototype.langs = +Accepts.prototype.language = +Accepts.prototype.languages = function (languages_) { + var languages = languages_ + + // support flattened arguments + if (languages && !Array.isArray(languages)) { + languages = new Array(arguments.length) + for (var i = 0; i < languages.length; i++) { + languages[i] = arguments[i] + } + } + + // no languages, return all requested languages + if (!languages || languages.length === 0) { + return this.negotiator.languages() + } + + return this.negotiator.languages(languages)[0] || false +} + +/** + * Convert extnames to mime. + * + * @param {String} type + * @return {String} + * @private + */ + +function extToMime (type) { + return type.indexOf('/') === -1 + ? mime.lookup(type) + : type +} + +/** + * Check if mime is valid. + * + * @param {String} type + * @return {String} + * @private + */ + +function validMime (type) { + return typeof type === 'string' +} diff --git a/src/Servers/ExpressServer/node_modules/accepts/package.json b/src/Servers/ExpressServer/node_modules/accepts/package.json new file mode 100644 index 0000000..0f2d15d --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/accepts/package.json @@ -0,0 +1,47 @@ +{ + "name": "accepts", + "description": "Higher-level content negotiation", + "version": "1.3.8", + "contributors": [ + "Douglas Christopher Wilson ", + "Jonathan Ong (http://jongleberry.com)" + ], + "license": "MIT", + "repository": "jshttp/accepts", + "dependencies": { + "mime-types": "~2.1.34", + "negotiator": "0.6.3" + }, + "devDependencies": { + "deep-equal": "1.0.1", + "eslint": "7.32.0", + "eslint-config-standard": "14.1.1", + "eslint-plugin-import": "2.25.4", + "eslint-plugin-markdown": "2.2.1", + "eslint-plugin-node": "11.1.0", + "eslint-plugin-promise": "4.3.1", + "eslint-plugin-standard": "4.1.0", + "mocha": "9.2.0", + "nyc": "15.1.0" + }, + "files": [ + "LICENSE", + "HISTORY.md", + "index.js" + ], + "engines": { + "node": ">= 0.6" + }, + "scripts": { + "lint": "eslint .", + "test": "mocha --reporter spec --check-leaks --bail test/", + "test-ci": "nyc --reporter=lcov --reporter=text npm test", + "test-cov": "nyc --reporter=html --reporter=text npm test" + }, + "keywords": [ + "content", + "negotiation", + "accept", + "accepts" + ] +} diff --git a/src/Servers/ExpressServer/node_modules/array-flatten/LICENSE b/src/Servers/ExpressServer/node_modules/array-flatten/LICENSE new file mode 100644 index 0000000..983fbe8 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/array-flatten/LICENSE @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2014 Blake Embrey (hello@blakeembrey.com) + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/src/Servers/ExpressServer/node_modules/array-flatten/README.md b/src/Servers/ExpressServer/node_modules/array-flatten/README.md new file mode 100644 index 0000000..91fa5b6 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/array-flatten/README.md @@ -0,0 +1,43 @@ +# Array Flatten + +[![NPM version][npm-image]][npm-url] +[![NPM downloads][downloads-image]][downloads-url] +[![Build status][travis-image]][travis-url] +[![Test coverage][coveralls-image]][coveralls-url] + +> Flatten an array of nested arrays into a single flat array. Accepts an optional depth. + +## Installation + +``` +npm install array-flatten --save +``` + +## Usage + +```javascript +var flatten = require('array-flatten') + +flatten([1, [2, [3, [4, [5], 6], 7], 8], 9]) +//=> [1, 2, 3, 4, 5, 6, 7, 8, 9] + +flatten([1, [2, [3, [4, [5], 6], 7], 8], 9], 2) +//=> [1, 2, 3, [4, [5], 6], 7, 8, 9] + +(function () { + flatten(arguments) //=> [1, 2, 3] +})(1, [2, 3]) +``` + +## License + +MIT + +[npm-image]: https://img.shields.io/npm/v/array-flatten.svg?style=flat +[npm-url]: https://npmjs.org/package/array-flatten +[downloads-image]: https://img.shields.io/npm/dm/array-flatten.svg?style=flat +[downloads-url]: https://npmjs.org/package/array-flatten +[travis-image]: https://img.shields.io/travis/blakeembrey/array-flatten.svg?style=flat +[travis-url]: https://travis-ci.org/blakeembrey/array-flatten +[coveralls-image]: https://img.shields.io/coveralls/blakeembrey/array-flatten.svg?style=flat +[coveralls-url]: https://coveralls.io/r/blakeembrey/array-flatten?branch=master diff --git a/src/Servers/ExpressServer/node_modules/array-flatten/array-flatten.js b/src/Servers/ExpressServer/node_modules/array-flatten/array-flatten.js new file mode 100644 index 0000000..089117b --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/array-flatten/array-flatten.js @@ -0,0 +1,64 @@ +'use strict' + +/** + * Expose `arrayFlatten`. + */ +module.exports = arrayFlatten + +/** + * Recursive flatten function with depth. + * + * @param {Array} array + * @param {Array} result + * @param {Number} depth + * @return {Array} + */ +function flattenWithDepth (array, result, depth) { + for (var i = 0; i < array.length; i++) { + var value = array[i] + + if (depth > 0 && Array.isArray(value)) { + flattenWithDepth(value, result, depth - 1) + } else { + result.push(value) + } + } + + return result +} + +/** + * Recursive flatten function. Omitting depth is slightly faster. + * + * @param {Array} array + * @param {Array} result + * @return {Array} + */ +function flattenForever (array, result) { + for (var i = 0; i < array.length; i++) { + var value = array[i] + + if (Array.isArray(value)) { + flattenForever(value, result) + } else { + result.push(value) + } + } + + return result +} + +/** + * Flatten an array, with the ability to define a depth. + * + * @param {Array} array + * @param {Number} depth + * @return {Array} + */ +function arrayFlatten (array, depth) { + if (depth == null) { + return flattenForever(array, []) + } + + return flattenWithDepth(array, [], depth) +} diff --git a/src/Servers/ExpressServer/node_modules/array-flatten/package.json b/src/Servers/ExpressServer/node_modules/array-flatten/package.json new file mode 100644 index 0000000..1a24e2a --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/array-flatten/package.json @@ -0,0 +1,39 @@ +{ + "name": "array-flatten", + "version": "1.1.1", + "description": "Flatten an array of nested arrays into a single flat array", + "main": "array-flatten.js", + "files": [ + "array-flatten.js", + "LICENSE" + ], + "scripts": { + "test": "istanbul cover _mocha -- -R spec" + }, + "repository": { + "type": "git", + "url": "git://github.com/blakeembrey/array-flatten.git" + }, + "keywords": [ + "array", + "flatten", + "arguments", + "depth" + ], + "author": { + "name": "Blake Embrey", + "email": "hello@blakeembrey.com", + "url": "http://blakeembrey.me" + }, + "license": "MIT", + "bugs": { + "url": "https://github.com/blakeembrey/array-flatten/issues" + }, + "homepage": "https://github.com/blakeembrey/array-flatten", + "devDependencies": { + "istanbul": "^0.3.13", + "mocha": "^2.2.4", + "pre-commit": "^1.0.7", + "standard": "^3.7.3" + } +} diff --git a/src/Servers/ExpressServer/node_modules/body-parser/HISTORY.md b/src/Servers/ExpressServer/node_modules/body-parser/HISTORY.md new file mode 100644 index 0000000..c9b0b5b --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/body-parser/HISTORY.md @@ -0,0 +1,680 @@ +1.20.4 / 2025-12-01 +=================== + + * deps: qs@~6.14.0 + * deps: use tilde notation for dependencies + * deps: http-errors@~2.0.1 + * deps: raw-body@~2.5.3 + +1.20.3 / 2024-09-10 +=================== + + * deps: qs@6.13.0 + * add `depth` option to customize the depth level in the parser + * IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`) + +1.20.2 / 2023-02-21 +=================== + + * Fix strict json error message on Node.js 19+ + * deps: content-type@~1.0.5 + - perf: skip value escaping when unnecessary + * deps: raw-body@2.5.2 + +1.20.1 / 2022-10-06 +=================== + + * deps: qs@6.11.0 + * perf: remove unnecessary object clone + +1.20.0 / 2022-04-02 +=================== + + * Fix error message for json parse whitespace in `strict` + * Fix internal error when inflated body exceeds limit + * Prevent loss of async hooks context + * Prevent hanging when request already read + * deps: depd@2.0.0 + - Replace internal `eval` usage with `Function` constructor + - Use instance methods on `process` to check for listeners + * deps: http-errors@2.0.0 + - deps: depd@2.0.0 + - deps: statuses@2.0.1 + * deps: on-finished@2.4.1 + * deps: qs@6.10.3 + * deps: raw-body@2.5.1 + - deps: http-errors@2.0.0 + +1.19.2 / 2022-02-15 +=================== + + * deps: bytes@3.1.2 + * deps: qs@6.9.7 + * Fix handling of `__proto__` keys + * deps: raw-body@2.4.3 + - deps: bytes@3.1.2 + +1.19.1 / 2021-12-10 +=================== + + * deps: bytes@3.1.1 + * deps: http-errors@1.8.1 + - deps: inherits@2.0.4 + - deps: toidentifier@1.0.1 + - deps: setprototypeof@1.2.0 + * deps: qs@6.9.6 + * deps: raw-body@2.4.2 + - deps: bytes@3.1.1 + - deps: http-errors@1.8.1 + * deps: safe-buffer@5.2.1 + * deps: type-is@~1.6.18 + +1.19.0 / 2019-04-25 +=================== + + * deps: bytes@3.1.0 + - Add petabyte (`pb`) support + * deps: http-errors@1.7.2 + - Set constructor name when possible + - deps: setprototypeof@1.1.1 + - deps: statuses@'>= 1.5.0 < 2' + * deps: iconv-lite@0.4.24 + - Added encoding MIK + * deps: qs@6.7.0 + - Fix parsing array brackets after index + * deps: raw-body@2.4.0 + - deps: bytes@3.1.0 + - deps: http-errors@1.7.2 + - deps: iconv-lite@0.4.24 + * deps: type-is@~1.6.17 + - deps: mime-types@~2.1.24 + - perf: prevent internal `throw` on invalid type + +1.18.3 / 2018-05-14 +=================== + + * Fix stack trace for strict json parse error + * deps: depd@~1.1.2 + - perf: remove argument reassignment + * deps: http-errors@~1.6.3 + - deps: depd@~1.1.2 + - deps: setprototypeof@1.1.0 + - deps: statuses@'>= 1.3.1 < 2' + * deps: iconv-lite@0.4.23 + - Fix loading encoding with year appended + - Fix deprecation warnings on Node.js 10+ + * deps: qs@6.5.2 + * deps: raw-body@2.3.3 + - deps: http-errors@1.6.3 + - deps: iconv-lite@0.4.23 + * deps: type-is@~1.6.16 + - deps: mime-types@~2.1.18 + +1.18.2 / 2017-09-22 +=================== + + * deps: debug@2.6.9 + * perf: remove argument reassignment + +1.18.1 / 2017-09-12 +=================== + + * deps: content-type@~1.0.4 + - perf: remove argument reassignment + - perf: skip parameter parsing when no parameters + * deps: iconv-lite@0.4.19 + - Fix ISO-8859-1 regression + - Update Windows-1255 + * deps: qs@6.5.1 + - Fix parsing & compacting very deep objects + * deps: raw-body@2.3.2 + - deps: iconv-lite@0.4.19 + +1.18.0 / 2017-09-08 +=================== + + * Fix JSON strict violation error to match native parse error + * Include the `body` property on verify errors + * Include the `type` property on all generated errors + * Use `http-errors` to set status code on errors + * deps: bytes@3.0.0 + * deps: debug@2.6.8 + * deps: depd@~1.1.1 + - Remove unnecessary `Buffer` loading + * deps: http-errors@~1.6.2 + - deps: depd@1.1.1 + * deps: iconv-lite@0.4.18 + - Add support for React Native + - Add a warning if not loaded as utf-8 + - Fix CESU-8 decoding in Node.js 8 + - Improve speed of ISO-8859-1 encoding + * deps: qs@6.5.0 + * deps: raw-body@2.3.1 + - Use `http-errors` for standard emitted errors + - deps: bytes@3.0.0 + - deps: iconv-lite@0.4.18 + - perf: skip buffer decoding on overage chunk + * perf: prevent internal `throw` when missing charset + +1.17.2 / 2017-05-17 +=================== + + * deps: debug@2.6.7 + - Fix `DEBUG_MAX_ARRAY_LENGTH` + - deps: ms@2.0.0 + * deps: type-is@~1.6.15 + - deps: mime-types@~2.1.15 + +1.17.1 / 2017-03-06 +=================== + + * deps: qs@6.4.0 + - Fix regression parsing keys starting with `[` + +1.17.0 / 2017-03-01 +=================== + + * deps: http-errors@~1.6.1 + - Make `message` property enumerable for `HttpError`s + - deps: setprototypeof@1.0.3 + * deps: qs@6.3.1 + - Fix compacting nested arrays + +1.16.1 / 2017-02-10 +=================== + + * deps: debug@2.6.1 + - Fix deprecation messages in WebStorm and other editors + - Undeprecate `DEBUG_FD` set to `1` or `2` + +1.16.0 / 2017-01-17 +=================== + + * deps: debug@2.6.0 + - Allow colors in workers + - Deprecated `DEBUG_FD` environment variable + - Fix error when running under React Native + - Use same color for same namespace + - deps: ms@0.7.2 + * deps: http-errors@~1.5.1 + - deps: inherits@2.0.3 + - deps: setprototypeof@1.0.2 + - deps: statuses@'>= 1.3.1 < 2' + * deps: iconv-lite@0.4.15 + - Added encoding MS-31J + - Added encoding MS-932 + - Added encoding MS-936 + - Added encoding MS-949 + - Added encoding MS-950 + - Fix GBK/GB18030 handling of Euro character + * deps: qs@6.2.1 + - Fix array parsing from skipping empty values + * deps: raw-body@~2.2.0 + - deps: iconv-lite@0.4.15 + * deps: type-is@~1.6.14 + - deps: mime-types@~2.1.13 + +1.15.2 / 2016-06-19 +=================== + + * deps: bytes@2.4.0 + * deps: content-type@~1.0.2 + - perf: enable strict mode + * deps: http-errors@~1.5.0 + - Use `setprototypeof` module to replace `__proto__` setting + - deps: statuses@'>= 1.3.0 < 2' + - perf: enable strict mode + * deps: qs@6.2.0 + * deps: raw-body@~2.1.7 + - deps: bytes@2.4.0 + - perf: remove double-cleanup on happy path + * deps: type-is@~1.6.13 + - deps: mime-types@~2.1.11 + +1.15.1 / 2016-05-05 +=================== + + * deps: bytes@2.3.0 + - Drop partial bytes on all parsed units + - Fix parsing byte string that looks like hex + * deps: raw-body@~2.1.6 + - deps: bytes@2.3.0 + * deps: type-is@~1.6.12 + - deps: mime-types@~2.1.10 + +1.15.0 / 2016-02-10 +=================== + + * deps: http-errors@~1.4.0 + - Add `HttpError` export, for `err instanceof createError.HttpError` + - deps: inherits@2.0.1 + - deps: statuses@'>= 1.2.1 < 2' + * deps: qs@6.1.0 + * deps: type-is@~1.6.11 + - deps: mime-types@~2.1.9 + +1.14.2 / 2015-12-16 +=================== + + * deps: bytes@2.2.0 + * deps: iconv-lite@0.4.13 + * deps: qs@5.2.0 + * deps: raw-body@~2.1.5 + - deps: bytes@2.2.0 + - deps: iconv-lite@0.4.13 + * deps: type-is@~1.6.10 + - deps: mime-types@~2.1.8 + +1.14.1 / 2015-09-27 +=================== + + * Fix issue where invalid charset results in 400 when `verify` used + * deps: iconv-lite@0.4.12 + - Fix CESU-8 decoding in Node.js 4.x + * deps: raw-body@~2.1.4 + - Fix masking critical errors from `iconv-lite` + - deps: iconv-lite@0.4.12 + * deps: type-is@~1.6.9 + - deps: mime-types@~2.1.7 + +1.14.0 / 2015-09-16 +=================== + + * Fix JSON strict parse error to match syntax errors + * Provide static `require` analysis in `urlencoded` parser + * deps: depd@~1.1.0 + - Support web browser loading + * deps: qs@5.1.0 + * deps: raw-body@~2.1.3 + - Fix sync callback when attaching data listener causes sync read + * deps: type-is@~1.6.8 + - Fix type error when given invalid type to match against + - deps: mime-types@~2.1.6 + +1.13.3 / 2015-07-31 +=================== + + * deps: type-is@~1.6.6 + - deps: mime-types@~2.1.4 + +1.13.2 / 2015-07-05 +=================== + + * deps: iconv-lite@0.4.11 + * deps: qs@4.0.0 + - Fix dropping parameters like `hasOwnProperty` + - Fix user-visible incompatibilities from 3.1.0 + - Fix various parsing edge cases + * deps: raw-body@~2.1.2 + - Fix error stack traces to skip `makeError` + - deps: iconv-lite@0.4.11 + * deps: type-is@~1.6.4 + - deps: mime-types@~2.1.2 + - perf: enable strict mode + - perf: remove argument reassignment + +1.13.1 / 2015-06-16 +=================== + + * deps: qs@2.4.2 + - Downgraded from 3.1.0 because of user-visible incompatibilities + +1.13.0 / 2015-06-14 +=================== + + * Add `statusCode` property on `Error`s, in addition to `status` + * Change `type` default to `application/json` for JSON parser + * Change `type` default to `application/x-www-form-urlencoded` for urlencoded parser + * Provide static `require` analysis + * Use the `http-errors` module to generate errors + * deps: bytes@2.1.0 + - Slight optimizations + * deps: iconv-lite@0.4.10 + - The encoding UTF-16 without BOM now defaults to UTF-16LE when detection fails + - Leading BOM is now removed when decoding + * deps: on-finished@~2.3.0 + - Add defined behavior for HTTP `CONNECT` requests + - Add defined behavior for HTTP `Upgrade` requests + - deps: ee-first@1.1.1 + * deps: qs@3.1.0 + - Fix dropping parameters like `hasOwnProperty` + - Fix various parsing edge cases + - Parsed object now has `null` prototype + * deps: raw-body@~2.1.1 + - Use `unpipe` module for unpiping requests + - deps: iconv-lite@0.4.10 + * deps: type-is@~1.6.3 + - deps: mime-types@~2.1.1 + - perf: reduce try block size + - perf: remove bitwise operations + * perf: enable strict mode + * perf: remove argument reassignment + * perf: remove delete call + +1.12.4 / 2015-05-10 +=================== + + * deps: debug@~2.2.0 + * deps: qs@2.4.2 + - Fix allowing parameters like `constructor` + * deps: on-finished@~2.2.1 + * deps: raw-body@~2.0.1 + - Fix a false-positive when unpiping in Node.js 0.8 + - deps: bytes@2.0.1 + * deps: type-is@~1.6.2 + - deps: mime-types@~2.0.11 + +1.12.3 / 2015-04-15 +=================== + + * Slight efficiency improvement when not debugging + * deps: depd@~1.0.1 + * deps: iconv-lite@0.4.8 + - Add encoding alias UNICODE-1-1-UTF-7 + * deps: raw-body@1.3.4 + - Fix hanging callback if request aborts during read + - deps: iconv-lite@0.4.8 + +1.12.2 / 2015-03-16 +=================== + + * deps: qs@2.4.1 + - Fix error when parameter `hasOwnProperty` is present + +1.12.1 / 2015-03-15 +=================== + + * deps: debug@~2.1.3 + - Fix high intensity foreground color for bold + - deps: ms@0.7.0 + * deps: type-is@~1.6.1 + - deps: mime-types@~2.0.10 + +1.12.0 / 2015-02-13 +=================== + + * add `debug` messages + * accept a function for the `type` option + * use `content-type` to parse `Content-Type` headers + * deps: iconv-lite@0.4.7 + - Gracefully support enumerables on `Object.prototype` + * deps: raw-body@1.3.3 + - deps: iconv-lite@0.4.7 + * deps: type-is@~1.6.0 + - fix argument reassignment + - fix false-positives in `hasBody` `Transfer-Encoding` check + - support wildcard for both type and subtype (`*/*`) + - deps: mime-types@~2.0.9 + +1.11.0 / 2015-01-30 +=================== + + * make internal `extended: true` depth limit infinity + * deps: type-is@~1.5.6 + - deps: mime-types@~2.0.8 + +1.10.2 / 2015-01-20 +=================== + + * deps: iconv-lite@0.4.6 + - Fix rare aliases of single-byte encodings + * deps: raw-body@1.3.2 + - deps: iconv-lite@0.4.6 + +1.10.1 / 2015-01-01 +=================== + + * deps: on-finished@~2.2.0 + * deps: type-is@~1.5.5 + - deps: mime-types@~2.0.7 + +1.10.0 / 2014-12-02 +=================== + + * make internal `extended: true` array limit dynamic + +1.9.3 / 2014-11-21 +================== + + * deps: iconv-lite@0.4.5 + - Fix Windows-31J and X-SJIS encoding support + * deps: qs@2.3.3 + - Fix `arrayLimit` behavior + * deps: raw-body@1.3.1 + - deps: iconv-lite@0.4.5 + * deps: type-is@~1.5.3 + - deps: mime-types@~2.0.3 + +1.9.2 / 2014-10-27 +================== + + * deps: qs@2.3.2 + - Fix parsing of mixed objects and values + +1.9.1 / 2014-10-22 +================== + + * deps: on-finished@~2.1.1 + - Fix handling of pipelined requests + * deps: qs@2.3.0 + - Fix parsing of mixed implicit and explicit arrays + * deps: type-is@~1.5.2 + - deps: mime-types@~2.0.2 + +1.9.0 / 2014-09-24 +================== + + * include the charset in "unsupported charset" error message + * include the encoding in "unsupported content encoding" error message + * deps: depd@~1.0.0 + +1.8.4 / 2014-09-23 +================== + + * fix content encoding to be case-insensitive + +1.8.3 / 2014-09-19 +================== + + * deps: qs@2.2.4 + - Fix issue with object keys starting with numbers truncated + +1.8.2 / 2014-09-15 +================== + + * deps: depd@0.4.5 + +1.8.1 / 2014-09-07 +================== + + * deps: media-typer@0.3.0 + * deps: type-is@~1.5.1 + +1.8.0 / 2014-09-05 +================== + + * make empty-body-handling consistent between chunked requests + - empty `json` produces `{}` + - empty `raw` produces `new Buffer(0)` + - empty `text` produces `''` + - empty `urlencoded` produces `{}` + * deps: qs@2.2.3 + - Fix issue where first empty value in array is discarded + * deps: type-is@~1.5.0 + - fix `hasbody` to be true for `content-length: 0` + +1.7.0 / 2014-09-01 +================== + + * add `parameterLimit` option to `urlencoded` parser + * change `urlencoded` extended array limit to 100 + * respond with 413 when over `parameterLimit` in `urlencoded` + +1.6.7 / 2014-08-29 +================== + + * deps: qs@2.2.2 + - Remove unnecessary cloning + +1.6.6 / 2014-08-27 +================== + + * deps: qs@2.2.0 + - Array parsing fix + - Performance improvements + +1.6.5 / 2014-08-16 +================== + + * deps: on-finished@2.1.0 + +1.6.4 / 2014-08-14 +================== + + * deps: qs@1.2.2 + +1.6.3 / 2014-08-10 +================== + + * deps: qs@1.2.1 + +1.6.2 / 2014-08-07 +================== + + * deps: qs@1.2.0 + - Fix parsing array of objects + +1.6.1 / 2014-08-06 +================== + + * deps: qs@1.1.0 + - Accept urlencoded square brackets + - Accept empty values in implicit array notation + +1.6.0 / 2014-08-05 +================== + + * deps: qs@1.0.2 + - Complete rewrite + - Limits array length to 20 + - Limits object depth to 5 + - Limits parameters to 1,000 + +1.5.2 / 2014-07-27 +================== + + * deps: depd@0.4.4 + - Work-around v8 generating empty stack traces + +1.5.1 / 2014-07-26 +================== + + * deps: depd@0.4.3 + - Fix exception when global `Error.stackTraceLimit` is too low + +1.5.0 / 2014-07-20 +================== + + * deps: depd@0.4.2 + - Add `TRACE_DEPRECATION` environment variable + - Remove non-standard grey color from color output + - Support `--no-deprecation` argument + - Support `--trace-deprecation` argument + * deps: iconv-lite@0.4.4 + - Added encoding UTF-7 + * deps: raw-body@1.3.0 + - deps: iconv-lite@0.4.4 + - Added encoding UTF-7 + - Fix `Cannot switch to old mode now` error on Node.js 0.10+ + * deps: type-is@~1.3.2 + +1.4.3 / 2014-06-19 +================== + + * deps: type-is@1.3.1 + - fix global variable leak + +1.4.2 / 2014-06-19 +================== + + * deps: type-is@1.3.0 + - improve type parsing + +1.4.1 / 2014-06-19 +================== + + * fix urlencoded extended deprecation message + +1.4.0 / 2014-06-19 +================== + + * add `text` parser + * add `raw` parser + * check accepted charset in content-type (accepts utf-8) + * check accepted encoding in content-encoding (accepts identity) + * deprecate `bodyParser()` middleware; use `.json()` and `.urlencoded()` as needed + * deprecate `urlencoded()` without provided `extended` option + * lazy-load urlencoded parsers + * parsers split into files for reduced mem usage + * support gzip and deflate bodies + - set `inflate: false` to turn off + * deps: raw-body@1.2.2 + - Support all encodings from `iconv-lite` + +1.3.1 / 2014-06-11 +================== + + * deps: type-is@1.2.1 + - Switch dependency from mime to mime-types@1.0.0 + +1.3.0 / 2014-05-31 +================== + + * add `extended` option to urlencoded parser + +1.2.2 / 2014-05-27 +================== + + * deps: raw-body@1.1.6 + - assert stream encoding on node.js 0.8 + - assert stream encoding on node.js < 0.10.6 + - deps: bytes@1 + +1.2.1 / 2014-05-26 +================== + + * invoke `next(err)` after request fully read + - prevents hung responses and socket hang ups + +1.2.0 / 2014-05-11 +================== + + * add `verify` option + * deps: type-is@1.2.0 + - support suffix matching + +1.1.2 / 2014-05-11 +================== + + * improve json parser speed + +1.1.1 / 2014-05-11 +================== + + * fix repeated limit parsing with every request + +1.1.0 / 2014-05-10 +================== + + * add `type` option + * deps: pin for safety and consistency + +1.0.2 / 2014-04-14 +================== + + * use `type-is` module + +1.0.1 / 2014-03-20 +================== + + * lower default limits to 100kb diff --git a/src/Servers/ExpressServer/node_modules/body-parser/LICENSE b/src/Servers/ExpressServer/node_modules/body-parser/LICENSE new file mode 100644 index 0000000..386b7b6 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/body-parser/LICENSE @@ -0,0 +1,23 @@ +(The MIT License) + +Copyright (c) 2014 Jonathan Ong +Copyright (c) 2014-2015 Douglas Christopher Wilson + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +'Software'), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/src/Servers/ExpressServer/node_modules/body-parser/README.md b/src/Servers/ExpressServer/node_modules/body-parser/README.md new file mode 100644 index 0000000..f6661b7 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/body-parser/README.md @@ -0,0 +1,476 @@ +# body-parser + +[![NPM Version][npm-version-image]][npm-url] +[![NPM Downloads][npm-downloads-image]][npm-url] +[![Build Status][ci-image]][ci-url] +[![Test Coverage][coveralls-image]][coveralls-url] +[![OpenSSF Scorecard Badge][ossf-scorecard-badge]][ossf-scorecard-visualizer] + +Node.js body parsing middleware. + +Parse incoming request bodies in a middleware before your handlers, available +under the `req.body` property. + +**Note** As `req.body`'s shape is based on user-controlled input, all +properties and values in this object are untrusted and should be validated +before trusting. For example, `req.body.foo.toString()` may fail in multiple +ways, for example the `foo` property may not be there or may not be a string, +and `toString` may not be a function and instead a string or other user input. + +[Learn about the anatomy of an HTTP transaction in Node.js](https://nodejs.org/en/docs/guides/anatomy-of-an-http-transaction/). + +_This does not handle multipart bodies_, due to their complex and typically +large nature. For multipart bodies, you may be interested in the following +modules: + + * [busboy](https://www.npmjs.org/package/busboy#readme) and + [connect-busboy](https://www.npmjs.org/package/connect-busboy#readme) + * [multiparty](https://www.npmjs.org/package/multiparty#readme) and + [connect-multiparty](https://www.npmjs.org/package/connect-multiparty#readme) + * [formidable](https://www.npmjs.org/package/formidable#readme) + * [multer](https://www.npmjs.org/package/multer#readme) + +This module provides the following parsers: + + * [JSON body parser](#bodyparserjsonoptions) + * [Raw body parser](#bodyparserrawoptions) + * [Text body parser](#bodyparsertextoptions) + * [URL-encoded form body parser](#bodyparserurlencodedoptions) + +Other body parsers you might be interested in: + +- [body](https://www.npmjs.org/package/body#readme) +- [co-body](https://www.npmjs.org/package/co-body#readme) + +## Installation + +```sh +$ npm install body-parser +``` + +## API + +```js +var bodyParser = require('body-parser') +``` + +The `bodyParser` object exposes various factories to create middlewares. All +middlewares will populate the `req.body` property with the parsed body when +the `Content-Type` request header matches the `type` option, or an empty +object (`{}`) if there was no body to parse, the `Content-Type` was not matched, +or an error occurred. + +The various errors returned by this module are described in the +[errors section](#errors). + +### bodyParser.json([options]) + +Returns middleware that only parses `json` and only looks at requests where +the `Content-Type` header matches the `type` option. This parser accepts any +Unicode encoding of the body and supports automatic inflation of `gzip` and +`deflate` encodings. + +A new `body` object containing the parsed data is populated on the `request` +object after the middleware (i.e. `req.body`). + +#### Options + +The `json` function takes an optional `options` object that may contain any of +the following keys: + +##### inflate + +When set to `true`, then deflated (compressed) bodies will be inflated; when +`false`, deflated bodies are rejected. Defaults to `true`. + +##### limit + +Controls the maximum request body size. If this is a number, then the value +specifies the number of bytes; if it is a string, the value is passed to the +[bytes](https://www.npmjs.com/package/bytes) library for parsing. Defaults +to `'100kb'`. + +##### reviver + +The `reviver` option is passed directly to `JSON.parse` as the second +argument. You can find more information on this argument +[in the MDN documentation about JSON.parse](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/parse#Example.3A_Using_the_reviver_parameter). + +##### strict + +When set to `true`, will only accept arrays and objects; when `false` will +accept anything `JSON.parse` accepts. Defaults to `true`. + +##### type + +The `type` option is used to determine what media type the middleware will +parse. This option can be a string, array of strings, or a function. If not a +function, `type` option is passed directly to the +[type-is](https://www.npmjs.org/package/type-is#readme) library and this can +be an extension name (like `json`), a mime type (like `application/json`), or +a mime type with a wildcard (like `*/*` or `*/json`). If a function, the `type` +option is called as `fn(req)` and the request is parsed if it returns a truthy +value. Defaults to `application/json`. + +##### verify + +The `verify` option, if supplied, is called as `verify(req, res, buf, encoding)`, +where `buf` is a `Buffer` of the raw request body and `encoding` is the +encoding of the request. The parsing can be aborted by throwing an error. + +### bodyParser.raw([options]) + +Returns middleware that parses all bodies as a `Buffer` and only looks at +requests where the `Content-Type` header matches the `type` option. This +parser supports automatic inflation of `gzip` and `deflate` encodings. + +A new `body` object containing the parsed data is populated on the `request` +object after the middleware (i.e. `req.body`). This will be a `Buffer` object +of the body. + +#### Options + +The `raw` function takes an optional `options` object that may contain any of +the following keys: + +##### inflate + +When set to `true`, then deflated (compressed) bodies will be inflated; when +`false`, deflated bodies are rejected. Defaults to `true`. + +##### limit + +Controls the maximum request body size. If this is a number, then the value +specifies the number of bytes; if it is a string, the value is passed to the +[bytes](https://www.npmjs.com/package/bytes) library for parsing. Defaults +to `'100kb'`. + +##### type + +The `type` option is used to determine what media type the middleware will +parse. This option can be a string, array of strings, or a function. +If not a function, `type` option is passed directly to the +[type-is](https://www.npmjs.org/package/type-is#readme) library and this +can be an extension name (like `bin`), a mime type (like +`application/octet-stream`), or a mime type with a wildcard (like `*/*` or +`application/*`). If a function, the `type` option is called as `fn(req)` +and the request is parsed if it returns a truthy value. Defaults to +`application/octet-stream`. + +##### verify + +The `verify` option, if supplied, is called as `verify(req, res, buf, encoding)`, +where `buf` is a `Buffer` of the raw request body and `encoding` is the +encoding of the request. The parsing can be aborted by throwing an error. + +### bodyParser.text([options]) + +Returns middleware that parses all bodies as a string and only looks at +requests where the `Content-Type` header matches the `type` option. This +parser supports automatic inflation of `gzip` and `deflate` encodings. + +A new `body` string containing the parsed data is populated on the `request` +object after the middleware (i.e. `req.body`). This will be a string of the +body. + +#### Options + +The `text` function takes an optional `options` object that may contain any of +the following keys: + +##### defaultCharset + +Specify the default character set for the text content if the charset is not +specified in the `Content-Type` header of the request. Defaults to `utf-8`. + +##### inflate + +When set to `true`, then deflated (compressed) bodies will be inflated; when +`false`, deflated bodies are rejected. Defaults to `true`. + +##### limit + +Controls the maximum request body size. If this is a number, then the value +specifies the number of bytes; if it is a string, the value is passed to the +[bytes](https://www.npmjs.com/package/bytes) library for parsing. Defaults +to `'100kb'`. + +##### type + +The `type` option is used to determine what media type the middleware will +parse. This option can be a string, array of strings, or a function. If not +a function, `type` option is passed directly to the +[type-is](https://www.npmjs.org/package/type-is#readme) library and this can +be an extension name (like `txt`), a mime type (like `text/plain`), or a mime +type with a wildcard (like `*/*` or `text/*`). If a function, the `type` +option is called as `fn(req)` and the request is parsed if it returns a +truthy value. Defaults to `text/plain`. + +##### verify + +The `verify` option, if supplied, is called as `verify(req, res, buf, encoding)`, +where `buf` is a `Buffer` of the raw request body and `encoding` is the +encoding of the request. The parsing can be aborted by throwing an error. + +### bodyParser.urlencoded([options]) + +Returns middleware that only parses `urlencoded` bodies and only looks at +requests where the `Content-Type` header matches the `type` option. This +parser accepts only UTF-8 encoding of the body and supports automatic +inflation of `gzip` and `deflate` encodings. + +A new `body` object containing the parsed data is populated on the `request` +object after the middleware (i.e. `req.body`). This object will contain +key-value pairs, where the value can be a string or array (when `extended` is +`false`), or any type (when `extended` is `true`). + +#### Options + +The `urlencoded` function takes an optional `options` object that may contain +any of the following keys: + +##### extended + +The `extended` option allows to choose between parsing the URL-encoded data +with the `querystring` library (when `false`) or the `qs` library (when +`true`). The "extended" syntax allows for rich objects and arrays to be +encoded into the URL-encoded format, allowing for a JSON-like experience +with URL-encoded. For more information, please +[see the qs library](https://www.npmjs.org/package/qs#readme). + +Defaults to `true`, but using the default has been deprecated. Please +research into the difference between `qs` and `querystring` and choose the +appropriate setting. + +##### inflate + +When set to `true`, then deflated (compressed) bodies will be inflated; when +`false`, deflated bodies are rejected. Defaults to `true`. + +##### limit + +Controls the maximum request body size. If this is a number, then the value +specifies the number of bytes; if it is a string, the value is passed to the +[bytes](https://www.npmjs.com/package/bytes) library for parsing. Defaults +to `'100kb'`. + +##### parameterLimit + +The `parameterLimit` option controls the maximum number of parameters that +are allowed in the URL-encoded data. If a request contains more parameters +than this value, a 413 will be returned to the client. Defaults to `1000`. + +##### type + +The `type` option is used to determine what media type the middleware will +parse. This option can be a string, array of strings, or a function. If not +a function, `type` option is passed directly to the +[type-is](https://www.npmjs.org/package/type-is#readme) library and this can +be an extension name (like `urlencoded`), a mime type (like +`application/x-www-form-urlencoded`), or a mime type with a wildcard (like +`*/x-www-form-urlencoded`). If a function, the `type` option is called as +`fn(req)` and the request is parsed if it returns a truthy value. Defaults +to `application/x-www-form-urlencoded`. + +##### verify + +The `verify` option, if supplied, is called as `verify(req, res, buf, encoding)`, +where `buf` is a `Buffer` of the raw request body and `encoding` is the +encoding of the request. The parsing can be aborted by throwing an error. + +#### depth + +The `depth` option is used to configure the maximum depth of the `qs` library when `extended` is `true`. This allows you to limit the amount of keys that are parsed and can be useful to prevent certain types of abuse. Defaults to `32`. It is recommended to keep this value as low as possible. + +## Errors + +The middlewares provided by this module create errors using the +[`http-errors` module](https://www.npmjs.com/package/http-errors). The errors +will typically have a `status`/`statusCode` property that contains the suggested +HTTP response code, an `expose` property to determine if the `message` property +should be displayed to the client, a `type` property to determine the type of +error without matching against the `message`, and a `body` property containing +the read body, if available. + +The following are the common errors created, though any error can come through +for various reasons. + +### content encoding unsupported + +This error will occur when the request had a `Content-Encoding` header that +contained an encoding but the "inflation" option was set to `false`. The +`status` property is set to `415`, the `type` property is set to +`'encoding.unsupported'`, and the `charset` property will be set to the +encoding that is unsupported. + +### entity parse failed + +This error will occur when the request contained an entity that could not be +parsed by the middleware. The `status` property is set to `400`, the `type` +property is set to `'entity.parse.failed'`, and the `body` property is set to +the entity value that failed parsing. + +### entity verify failed + +This error will occur when the request contained an entity that could not be +failed verification by the defined `verify` option. The `status` property is +set to `403`, the `type` property is set to `'entity.verify.failed'`, and the +`body` property is set to the entity value that failed verification. + +### request aborted + +This error will occur when the request is aborted by the client before reading +the body has finished. The `received` property will be set to the number of +bytes received before the request was aborted and the `expected` property is +set to the number of expected bytes. The `status` property is set to `400` +and `type` property is set to `'request.aborted'`. + +### request entity too large + +This error will occur when the request body's size is larger than the "limit" +option. The `limit` property will be set to the byte limit and the `length` +property will be set to the request body's length. The `status` property is +set to `413` and the `type` property is set to `'entity.too.large'`. + +### request size did not match content length + +This error will occur when the request's length did not match the length from +the `Content-Length` header. This typically occurs when the request is malformed, +typically when the `Content-Length` header was calculated based on characters +instead of bytes. The `status` property is set to `400` and the `type` property +is set to `'request.size.invalid'`. + +### stream encoding should not be set + +This error will occur when something called the `req.setEncoding` method prior +to this middleware. This module operates directly on bytes only and you cannot +call `req.setEncoding` when using this module. The `status` property is set to +`500` and the `type` property is set to `'stream.encoding.set'`. + +### stream is not readable + +This error will occur when the request is no longer readable when this middleware +attempts to read it. This typically means something other than a middleware from +this module read the request body already and the middleware was also configured to +read the same request. The `status` property is set to `500` and the `type` +property is set to `'stream.not.readable'`. + +### too many parameters + +This error will occur when the content of the request exceeds the configured +`parameterLimit` for the `urlencoded` parser. The `status` property is set to +`413` and the `type` property is set to `'parameters.too.many'`. + +### unsupported charset "BOGUS" + +This error will occur when the request had a charset parameter in the +`Content-Type` header, but the `iconv-lite` module does not support it OR the +parser does not support it. The charset is contained in the message as well +as in the `charset` property. The `status` property is set to `415`, the +`type` property is set to `'charset.unsupported'`, and the `charset` property +is set to the charset that is unsupported. + +### unsupported content encoding "bogus" + +This error will occur when the request had a `Content-Encoding` header that +contained an unsupported encoding. The encoding is contained in the message +as well as in the `encoding` property. The `status` property is set to `415`, +the `type` property is set to `'encoding.unsupported'`, and the `encoding` +property is set to the encoding that is unsupported. + +### The input exceeded the depth + +This error occurs when using `bodyParser.urlencoded` with the `extended` property set to `true` and the input exceeds the configured `depth` option. The `status` property is set to `400`. It is recommended to review the `depth` option and evaluate if it requires a higher value. When the `depth` option is set to `32` (default value), the error will not be thrown. + +## Examples + +### Express/Connect top-level generic + +This example demonstrates adding a generic JSON and URL-encoded parser as a +top-level middleware, which will parse the bodies of all incoming requests. +This is the simplest setup. + +```js +var express = require('express') +var bodyParser = require('body-parser') + +var app = express() + +// parse application/x-www-form-urlencoded +app.use(bodyParser.urlencoded({ extended: false })) + +// parse application/json +app.use(bodyParser.json()) + +app.use(function (req, res) { + res.setHeader('Content-Type', 'text/plain') + res.write('you posted:\n') + res.end(JSON.stringify(req.body, null, 2)) +}) +``` + +### Express route-specific + +This example demonstrates adding body parsers specifically to the routes that +need them. In general, this is the most recommended way to use body-parser with +Express. + +```js +var express = require('express') +var bodyParser = require('body-parser') + +var app = express() + +// create application/json parser +var jsonParser = bodyParser.json() + +// create application/x-www-form-urlencoded parser +var urlencodedParser = bodyParser.urlencoded({ extended: false }) + +// POST /login gets urlencoded bodies +app.post('/login', urlencodedParser, function (req, res) { + res.send('welcome, ' + req.body.username) +}) + +// POST /api/users gets JSON bodies +app.post('/api/users', jsonParser, function (req, res) { + // create user in req.body +}) +``` + +### Change accepted type for parsers + +All the parsers accept a `type` option which allows you to change the +`Content-Type` that the middleware will parse. + +```js +var express = require('express') +var bodyParser = require('body-parser') + +var app = express() + +// parse various different custom JSON types as JSON +app.use(bodyParser.json({ type: 'application/*+json' })) + +// parse some custom thing into a Buffer +app.use(bodyParser.raw({ type: 'application/vnd.custom-type' })) + +// parse an HTML body into a string +app.use(bodyParser.text({ type: 'text/html' })) +``` + +## License + +[MIT](LICENSE) + +[ci-image]: https://badgen.net/github/checks/expressjs/body-parser/master?label=ci +[ci-url]: https://github.com/expressjs/body-parser/actions/workflows/ci.yml +[coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/body-parser/master +[coveralls-url]: https://coveralls.io/r/expressjs/body-parser?branch=master +[node-version-image]: https://badgen.net/npm/node/body-parser +[node-version-url]: https://nodejs.org/en/download +[npm-downloads-image]: https://badgen.net/npm/dm/body-parser +[npm-url]: https://npmjs.org/package/body-parser +[npm-version-image]: https://badgen.net/npm/v/body-parser +[ossf-scorecard-badge]: https://api.scorecard.dev/projects/github.com/expressjs/body-parser/badge +[ossf-scorecard-visualizer]: https://ossf.github.io/scorecard-visualizer/#/projects/github.com/expressjs/body-parser \ No newline at end of file diff --git a/src/Servers/ExpressServer/node_modules/body-parser/index.js b/src/Servers/ExpressServer/node_modules/body-parser/index.js new file mode 100644 index 0000000..bb24d73 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/body-parser/index.js @@ -0,0 +1,156 @@ +/*! + * body-parser + * Copyright(c) 2014-2015 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + * @private + */ + +var deprecate = require('depd')('body-parser') + +/** + * Cache of loaded parsers. + * @private + */ + +var parsers = Object.create(null) + +/** + * @typedef Parsers + * @type {function} + * @property {function} json + * @property {function} raw + * @property {function} text + * @property {function} urlencoded + */ + +/** + * Module exports. + * @type {Parsers} + */ + +exports = module.exports = deprecate.function(bodyParser, + 'bodyParser: use individual json/urlencoded middlewares') + +/** + * JSON parser. + * @public + */ + +Object.defineProperty(exports, 'json', { + configurable: true, + enumerable: true, + get: createParserGetter('json') +}) + +/** + * Raw parser. + * @public + */ + +Object.defineProperty(exports, 'raw', { + configurable: true, + enumerable: true, + get: createParserGetter('raw') +}) + +/** + * Text parser. + * @public + */ + +Object.defineProperty(exports, 'text', { + configurable: true, + enumerable: true, + get: createParserGetter('text') +}) + +/** + * URL-encoded parser. + * @public + */ + +Object.defineProperty(exports, 'urlencoded', { + configurable: true, + enumerable: true, + get: createParserGetter('urlencoded') +}) + +/** + * Create a middleware to parse json and urlencoded bodies. + * + * @param {object} [options] + * @return {function} + * @deprecated + * @public + */ + +function bodyParser (options) { + // use default type for parsers + var opts = Object.create(options || null, { + type: { + configurable: true, + enumerable: true, + value: undefined, + writable: true + } + }) + + var _urlencoded = exports.urlencoded(opts) + var _json = exports.json(opts) + + return function bodyParser (req, res, next) { + _json(req, res, function (err) { + if (err) return next(err) + _urlencoded(req, res, next) + }) + } +} + +/** + * Create a getter for loading a parser. + * @private + */ + +function createParserGetter (name) { + return function get () { + return loadParser(name) + } +} + +/** + * Load a parser module. + * @private + */ + +function loadParser (parserName) { + var parser = parsers[parserName] + + if (parser !== undefined) { + return parser + } + + // this uses a switch for static require analysis + switch (parserName) { + case 'json': + parser = require('./lib/types/json') + break + case 'raw': + parser = require('./lib/types/raw') + break + case 'text': + parser = require('./lib/types/text') + break + case 'urlencoded': + parser = require('./lib/types/urlencoded') + break + } + + // store to prevent invoking require() + return (parsers[parserName] = parser) +} diff --git a/src/Servers/ExpressServer/node_modules/body-parser/lib/read.js b/src/Servers/ExpressServer/node_modules/body-parser/lib/read.js new file mode 100644 index 0000000..fce6283 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/body-parser/lib/read.js @@ -0,0 +1,205 @@ +/*! + * body-parser + * Copyright(c) 2014-2015 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + * @private + */ + +var createError = require('http-errors') +var destroy = require('destroy') +var getBody = require('raw-body') +var iconv = require('iconv-lite') +var onFinished = require('on-finished') +var unpipe = require('unpipe') +var zlib = require('zlib') + +/** + * Module exports. + */ + +module.exports = read + +/** + * Read a request into a buffer and parse. + * + * @param {object} req + * @param {object} res + * @param {function} next + * @param {function} parse + * @param {function} debug + * @param {object} options + * @private + */ + +function read (req, res, next, parse, debug, options) { + var length + var opts = options + var stream + + // flag as parsed + req._body = true + + // read options + var encoding = opts.encoding !== null + ? opts.encoding + : null + var verify = opts.verify + + try { + // get the content stream + stream = contentstream(req, debug, opts.inflate) + length = stream.length + stream.length = undefined + } catch (err) { + return next(err) + } + + // set raw-body options + opts.length = length + opts.encoding = verify + ? null + : encoding + + // assert charset is supported + if (opts.encoding === null && encoding !== null && !iconv.encodingExists(encoding)) { + return next(createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', { + charset: encoding.toLowerCase(), + type: 'charset.unsupported' + })) + } + + // read body + debug('read body') + getBody(stream, opts, function (error, body) { + if (error) { + var _error + + if (error.type === 'encoding.unsupported') { + // echo back charset + _error = createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', { + charset: encoding.toLowerCase(), + type: 'charset.unsupported' + }) + } else { + // set status code on error + _error = createError(400, error) + } + + // unpipe from stream and destroy + if (stream !== req) { + unpipe(req) + destroy(stream, true) + } + + // read off entire request + dump(req, function onfinished () { + next(createError(400, _error)) + }) + return + } + + // verify + if (verify) { + try { + debug('verify body') + verify(req, res, body, encoding) + } catch (err) { + next(createError(403, err, { + body: body, + type: err.type || 'entity.verify.failed' + })) + return + } + } + + // parse + var str = body + try { + debug('parse body') + str = typeof body !== 'string' && encoding !== null + ? iconv.decode(body, encoding) + : body + req.body = parse(str) + } catch (err) { + next(createError(400, err, { + body: str, + type: err.type || 'entity.parse.failed' + })) + return + } + + next() + }) +} + +/** + * Get the content stream of the request. + * + * @param {object} req + * @param {function} debug + * @param {boolean} [inflate=true] + * @return {object} + * @api private + */ + +function contentstream (req, debug, inflate) { + var encoding = (req.headers['content-encoding'] || 'identity').toLowerCase() + var length = req.headers['content-length'] + var stream + + debug('content-encoding "%s"', encoding) + + if (inflate === false && encoding !== 'identity') { + throw createError(415, 'content encoding unsupported', { + encoding: encoding, + type: 'encoding.unsupported' + }) + } + + switch (encoding) { + case 'deflate': + stream = zlib.createInflate() + debug('inflate body') + req.pipe(stream) + break + case 'gzip': + stream = zlib.createGunzip() + debug('gunzip body') + req.pipe(stream) + break + case 'identity': + stream = req + stream.length = length + break + default: + throw createError(415, 'unsupported content encoding "' + encoding + '"', { + encoding: encoding, + type: 'encoding.unsupported' + }) + } + + return stream +} + +/** + * Dump the contents of a request. + * + * @param {object} req + * @param {function} callback + * @api private + */ + +function dump (req, callback) { + if (onFinished.isFinished(req)) { + callback(null) + } else { + onFinished(req, callback) + req.resume() + } +} diff --git a/src/Servers/ExpressServer/node_modules/body-parser/lib/types/json.js b/src/Servers/ExpressServer/node_modules/body-parser/lib/types/json.js new file mode 100644 index 0000000..59f3f7e --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/body-parser/lib/types/json.js @@ -0,0 +1,247 @@ +/*! + * body-parser + * Copyright(c) 2014 Jonathan Ong + * Copyright(c) 2014-2015 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + * @private + */ + +var bytes = require('bytes') +var contentType = require('content-type') +var createError = require('http-errors') +var debug = require('debug')('body-parser:json') +var read = require('../read') +var typeis = require('type-is') + +/** + * Module exports. + */ + +module.exports = json + +/** + * RegExp to match the first non-space in a string. + * + * Allowed whitespace is defined in RFC 7159: + * + * ws = *( + * %x20 / ; Space + * %x09 / ; Horizontal tab + * %x0A / ; Line feed or New line + * %x0D ) ; Carriage return + */ + +var FIRST_CHAR_REGEXP = /^[\x20\x09\x0a\x0d]*([^\x20\x09\x0a\x0d])/ // eslint-disable-line no-control-regex + +var JSON_SYNTAX_CHAR = '#' +var JSON_SYNTAX_REGEXP = /#+/g + +/** + * Create a middleware to parse JSON bodies. + * + * @param {object} [options] + * @return {function} + * @public + */ + +function json (options) { + var opts = options || {} + + var limit = typeof opts.limit !== 'number' + ? bytes.parse(opts.limit || '100kb') + : opts.limit + var inflate = opts.inflate !== false + var reviver = opts.reviver + var strict = opts.strict !== false + var type = opts.type || 'application/json' + var verify = opts.verify || false + + if (verify !== false && typeof verify !== 'function') { + throw new TypeError('option verify must be function') + } + + // create the appropriate type checking function + var shouldParse = typeof type !== 'function' + ? typeChecker(type) + : type + + function parse (body) { + if (body.length === 0) { + // special-case empty json body, as it's a common client-side mistake + // TODO: maybe make this configurable or part of "strict" option + return {} + } + + if (strict) { + var first = firstchar(body) + + if (first !== '{' && first !== '[') { + debug('strict violation') + throw createStrictSyntaxError(body, first) + } + } + + try { + debug('parse json') + return JSON.parse(body, reviver) + } catch (e) { + throw normalizeJsonSyntaxError(e, { + message: e.message, + stack: e.stack + }) + } + } + + return function jsonParser (req, res, next) { + if (req._body) { + debug('body already parsed') + next() + return + } + + req.body = req.body || {} + + // skip requests without bodies + if (!typeis.hasBody(req)) { + debug('skip empty body') + next() + return + } + + debug('content-type %j', req.headers['content-type']) + + // determine if request should be parsed + if (!shouldParse(req)) { + debug('skip parsing') + next() + return + } + + // assert charset per RFC 7159 sec 8.1 + var charset = getCharset(req) || 'utf-8' + if (charset.slice(0, 4) !== 'utf-') { + debug('invalid charset') + next(createError(415, 'unsupported charset "' + charset.toUpperCase() + '"', { + charset: charset, + type: 'charset.unsupported' + })) + return + } + + // read + read(req, res, next, parse, debug, { + encoding: charset, + inflate: inflate, + limit: limit, + verify: verify + }) + } +} + +/** + * Create strict violation syntax error matching native error. + * + * @param {string} str + * @param {string} char + * @return {Error} + * @private + */ + +function createStrictSyntaxError (str, char) { + var index = str.indexOf(char) + var partial = '' + + if (index !== -1) { + partial = str.substring(0, index) + JSON_SYNTAX_CHAR + + for (var i = index + 1; i < str.length; i++) { + partial += JSON_SYNTAX_CHAR + } + } + + try { + JSON.parse(partial); /* istanbul ignore next */ throw new SyntaxError('strict violation') + } catch (e) { + return normalizeJsonSyntaxError(e, { + message: e.message.replace(JSON_SYNTAX_REGEXP, function (placeholder) { + return str.substring(index, index + placeholder.length) + }), + stack: e.stack + }) + } +} + +/** + * Get the first non-whitespace character in a string. + * + * @param {string} str + * @return {function} + * @private + */ + +function firstchar (str) { + var match = FIRST_CHAR_REGEXP.exec(str) + + return match + ? match[1] + : undefined +} + +/** + * Get the charset of a request. + * + * @param {object} req + * @api private + */ + +function getCharset (req) { + try { + return (contentType.parse(req).parameters.charset || '').toLowerCase() + } catch (e) { + return undefined + } +} + +/** + * Normalize a SyntaxError for JSON.parse. + * + * @param {SyntaxError} error + * @param {object} obj + * @return {SyntaxError} + */ + +function normalizeJsonSyntaxError (error, obj) { + var keys = Object.getOwnPropertyNames(error) + + for (var i = 0; i < keys.length; i++) { + var key = keys[i] + if (key !== 'stack' && key !== 'message') { + delete error[key] + } + } + + // replace stack before message for Node.js 0.10 and below + error.stack = obj.stack.replace(error.message, obj.message) + error.message = obj.message + + return error +} + +/** + * Get the simple type checker. + * + * @param {string} type + * @return {function} + */ + +function typeChecker (type) { + return function checkType (req) { + return Boolean(typeis(req, type)) + } +} diff --git a/src/Servers/ExpressServer/node_modules/body-parser/lib/types/raw.js b/src/Servers/ExpressServer/node_modules/body-parser/lib/types/raw.js new file mode 100644 index 0000000..f5d1b67 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/body-parser/lib/types/raw.js @@ -0,0 +1,101 @@ +/*! + * body-parser + * Copyright(c) 2014-2015 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + */ + +var bytes = require('bytes') +var debug = require('debug')('body-parser:raw') +var read = require('../read') +var typeis = require('type-is') + +/** + * Module exports. + */ + +module.exports = raw + +/** + * Create a middleware to parse raw bodies. + * + * @param {object} [options] + * @return {function} + * @api public + */ + +function raw (options) { + var opts = options || {} + + var inflate = opts.inflate !== false + var limit = typeof opts.limit !== 'number' + ? bytes.parse(opts.limit || '100kb') + : opts.limit + var type = opts.type || 'application/octet-stream' + var verify = opts.verify || false + + if (verify !== false && typeof verify !== 'function') { + throw new TypeError('option verify must be function') + } + + // create the appropriate type checking function + var shouldParse = typeof type !== 'function' + ? typeChecker(type) + : type + + function parse (buf) { + return buf + } + + return function rawParser (req, res, next) { + if (req._body) { + debug('body already parsed') + next() + return + } + + req.body = req.body || {} + + // skip requests without bodies + if (!typeis.hasBody(req)) { + debug('skip empty body') + next() + return + } + + debug('content-type %j', req.headers['content-type']) + + // determine if request should be parsed + if (!shouldParse(req)) { + debug('skip parsing') + next() + return + } + + // read + read(req, res, next, parse, debug, { + encoding: null, + inflate: inflate, + limit: limit, + verify: verify + }) + } +} + +/** + * Get the simple type checker. + * + * @param {string} type + * @return {function} + */ + +function typeChecker (type) { + return function checkType (req) { + return Boolean(typeis(req, type)) + } +} diff --git a/src/Servers/ExpressServer/node_modules/body-parser/lib/types/text.js b/src/Servers/ExpressServer/node_modules/body-parser/lib/types/text.js new file mode 100644 index 0000000..083a009 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/body-parser/lib/types/text.js @@ -0,0 +1,121 @@ +/*! + * body-parser + * Copyright(c) 2014-2015 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + */ + +var bytes = require('bytes') +var contentType = require('content-type') +var debug = require('debug')('body-parser:text') +var read = require('../read') +var typeis = require('type-is') + +/** + * Module exports. + */ + +module.exports = text + +/** + * Create a middleware to parse text bodies. + * + * @param {object} [options] + * @return {function} + * @api public + */ + +function text (options) { + var opts = options || {} + + var defaultCharset = opts.defaultCharset || 'utf-8' + var inflate = opts.inflate !== false + var limit = typeof opts.limit !== 'number' + ? bytes.parse(opts.limit || '100kb') + : opts.limit + var type = opts.type || 'text/plain' + var verify = opts.verify || false + + if (verify !== false && typeof verify !== 'function') { + throw new TypeError('option verify must be function') + } + + // create the appropriate type checking function + var shouldParse = typeof type !== 'function' + ? typeChecker(type) + : type + + function parse (buf) { + return buf + } + + return function textParser (req, res, next) { + if (req._body) { + debug('body already parsed') + next() + return + } + + req.body = req.body || {} + + // skip requests without bodies + if (!typeis.hasBody(req)) { + debug('skip empty body') + next() + return + } + + debug('content-type %j', req.headers['content-type']) + + // determine if request should be parsed + if (!shouldParse(req)) { + debug('skip parsing') + next() + return + } + + // get charset + var charset = getCharset(req) || defaultCharset + + // read + read(req, res, next, parse, debug, { + encoding: charset, + inflate: inflate, + limit: limit, + verify: verify + }) + } +} + +/** + * Get the charset of a request. + * + * @param {object} req + * @api private + */ + +function getCharset (req) { + try { + return (contentType.parse(req).parameters.charset || '').toLowerCase() + } catch (e) { + return undefined + } +} + +/** + * Get the simple type checker. + * + * @param {string} type + * @return {function} + */ + +function typeChecker (type) { + return function checkType (req) { + return Boolean(typeis(req, type)) + } +} diff --git a/src/Servers/ExpressServer/node_modules/body-parser/lib/types/urlencoded.js b/src/Servers/ExpressServer/node_modules/body-parser/lib/types/urlencoded.js new file mode 100644 index 0000000..832992c --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/body-parser/lib/types/urlencoded.js @@ -0,0 +1,300 @@ +/*! + * body-parser + * Copyright(c) 2014 Jonathan Ong + * Copyright(c) 2014-2015 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + * @private + */ + +var bytes = require('bytes') +var contentType = require('content-type') +var createError = require('http-errors') +var debug = require('debug')('body-parser:urlencoded') +var deprecate = require('depd')('body-parser') +var read = require('../read') +var typeis = require('type-is') + +/** + * Module exports. + */ + +module.exports = urlencoded + +/** + * Cache of parser modules. + */ + +var parsers = Object.create(null) + +/** + * Create a middleware to parse urlencoded bodies. + * + * @param {object} [options] + * @return {function} + * @public + */ + +function urlencoded (options) { + var opts = options || {} + + // notice because option default will flip in next major + if (opts.extended === undefined) { + deprecate('undefined extended: provide extended option') + } + + var extended = opts.extended !== false + var inflate = opts.inflate !== false + var limit = typeof opts.limit !== 'number' + ? bytes.parse(opts.limit || '100kb') + : opts.limit + var type = opts.type || 'application/x-www-form-urlencoded' + var verify = opts.verify || false + + if (verify !== false && typeof verify !== 'function') { + throw new TypeError('option verify must be function') + } + + // create the appropriate query parser + var queryparse = extended + ? extendedparser(opts) + : simpleparser(opts) + + // create the appropriate type checking function + var shouldParse = typeof type !== 'function' + ? typeChecker(type) + : type + + function parse (body) { + return body.length + ? queryparse(body) + : {} + } + + return function urlencodedParser (req, res, next) { + if (req._body) { + debug('body already parsed') + next() + return + } + + req.body = req.body || {} + + // skip requests without bodies + if (!typeis.hasBody(req)) { + debug('skip empty body') + next() + return + } + + debug('content-type %j', req.headers['content-type']) + + // determine if request should be parsed + if (!shouldParse(req)) { + debug('skip parsing') + next() + return + } + + // assert charset + var charset = getCharset(req) || 'utf-8' + if (charset !== 'utf-8') { + debug('invalid charset') + next(createError(415, 'unsupported charset "' + charset.toUpperCase() + '"', { + charset: charset, + type: 'charset.unsupported' + })) + return + } + + // read + read(req, res, next, parse, debug, { + debug: debug, + encoding: charset, + inflate: inflate, + limit: limit, + verify: verify + }) + } +} + +/** + * Get the extended query parser. + * + * @param {object} options + */ + +function extendedparser (options) { + var parameterLimit = options.parameterLimit !== undefined + ? options.parameterLimit + : 1000 + var depth = options.depth !== undefined ? options.depth : 32 + var parse = parser('qs') + + if (isNaN(parameterLimit) || parameterLimit < 1) { + throw new TypeError('option parameterLimit must be a positive number') + } + + if (isNaN(depth) || depth < 0) { + throw new TypeError('option depth must be a zero or a positive number') + } + + if (isFinite(parameterLimit)) { + parameterLimit = parameterLimit | 0 + } + + return function queryparse (body) { + var paramCount = parameterCount(body, parameterLimit) + + if (paramCount === undefined) { + debug('too many parameters') + throw createError(413, 'too many parameters', { + type: 'parameters.too.many' + }) + } + + var arrayLimit = Math.max(100, paramCount) + + debug('parse extended urlencoding') + try { + return parse(body, { + allowPrototypes: true, + arrayLimit: arrayLimit, + depth: depth, + strictDepth: true, + parameterLimit: parameterLimit + }) + } catch (err) { + if (err instanceof RangeError) { + throw createError(400, 'The input exceeded the depth', { + type: 'querystring.parse.rangeError' + }) + } else { + throw err + } + } + } +} + +/** + * Get the charset of a request. + * + * @param {object} req + * @api private + */ + +function getCharset (req) { + try { + return (contentType.parse(req).parameters.charset || '').toLowerCase() + } catch (e) { + return undefined + } +} + +/** + * Count the number of parameters, stopping once limit reached + * + * @param {string} body + * @param {number} limit + * @api private + */ + +function parameterCount (body, limit) { + var count = 0 + var index = 0 + + while ((index = body.indexOf('&', index)) !== -1) { + count++ + index++ + + if (count === limit) { + return undefined + } + } + + return count +} + +/** + * Get parser for module name dynamically. + * + * @param {string} name + * @return {function} + * @api private + */ + +function parser (name) { + var mod = parsers[name] + + if (mod !== undefined) { + return mod.parse + } + + // this uses a switch for static require analysis + switch (name) { + case 'qs': + mod = require('qs') + break + case 'querystring': + mod = require('querystring') + break + } + + // store to prevent invoking require() + parsers[name] = mod + + return mod.parse +} + +/** + * Get the simple query parser. + * + * @param {object} options + */ + +function simpleparser (options) { + var parameterLimit = options.parameterLimit !== undefined + ? options.parameterLimit + : 1000 + var parse = parser('querystring') + + if (isNaN(parameterLimit) || parameterLimit < 1) { + throw new TypeError('option parameterLimit must be a positive number') + } + + if (isFinite(parameterLimit)) { + parameterLimit = parameterLimit | 0 + } + + return function queryparse (body) { + var paramCount = parameterCount(body, parameterLimit) + + if (paramCount === undefined) { + debug('too many parameters') + throw createError(413, 'too many parameters', { + type: 'parameters.too.many' + }) + } + + debug('parse urlencoding') + return parse(body, undefined, undefined, { maxKeys: parameterLimit }) + } +} + +/** + * Get the simple type checker. + * + * @param {string} type + * @return {function} + */ + +function typeChecker (type) { + return function checkType (req) { + return Boolean(typeis(req, type)) + } +} diff --git a/src/Servers/ExpressServer/node_modules/body-parser/package.json b/src/Servers/ExpressServer/node_modules/body-parser/package.json new file mode 100644 index 0000000..c8e61c1 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/body-parser/package.json @@ -0,0 +1,55 @@ +{ + "name": "body-parser", + "description": "Node.js body parsing middleware", + "version": "1.20.4", + "contributors": [ + "Douglas Christopher Wilson ", + "Jonathan Ong (http://jongleberry.com)" + ], + "license": "MIT", + "repository": "expressjs/body-parser", + "dependencies": { + "bytes": "~3.1.2", + "content-type": "~1.0.5", + "debug": "2.6.9", + "depd": "2.0.0", + "destroy": "~1.2.0", + "http-errors": "~2.0.1", + "iconv-lite": "~0.4.24", + "on-finished": "~2.4.1", + "qs": "~6.14.0", + "raw-body": "~2.5.3", + "type-is": "~1.6.18", + "unpipe": "~1.0.0" + }, + "devDependencies": { + "eslint": "8.34.0", + "eslint-config-standard": "14.1.1", + "eslint-plugin-import": "2.27.5", + "eslint-plugin-markdown": "3.0.0", + "eslint-plugin-node": "11.1.0", + "eslint-plugin-promise": "6.1.1", + "eslint-plugin-standard": "4.1.0", + "methods": "1.1.2", + "mocha": "10.2.0", + "nyc": "15.1.0", + "safe-buffer": "5.2.1", + "supertest": "6.3.3" + }, + "files": [ + "lib/", + "LICENSE", + "HISTORY.md", + "index.js" + ], + "engines": { + "node": ">= 0.8", + "npm": "1.2.8000 || >= 1.4.16" + }, + "scripts": { + "lint": "eslint .", + "test": "mocha --require test/support/env --reporter spec --check-leaks --bail test/", + "test-ci": "nyc --reporter=lcov --reporter=text npm test", + "test-cov": "nyc --reporter=html --reporter=text npm test" + } +} diff --git a/src/Servers/ExpressServer/node_modules/bytes/History.md b/src/Servers/ExpressServer/node_modules/bytes/History.md new file mode 100644 index 0000000..d60ce0e --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/bytes/History.md @@ -0,0 +1,97 @@ +3.1.2 / 2022-01-27 +================== + + * Fix return value for un-parsable strings + +3.1.1 / 2021-11-15 +================== + + * Fix "thousandsSeparator" incorrecting formatting fractional part + +3.1.0 / 2019-01-22 +================== + + * Add petabyte (`pb`) support + +3.0.0 / 2017-08-31 +================== + + * Change "kB" to "KB" in format output + * Remove support for Node.js 0.6 + * Remove support for ComponentJS + +2.5.0 / 2017-03-24 +================== + + * Add option "unit" + +2.4.0 / 2016-06-01 +================== + + * Add option "unitSeparator" + +2.3.0 / 2016-02-15 +================== + + * Drop partial bytes on all parsed units + * Fix non-finite numbers to `.format` to return `null` + * Fix parsing byte string that looks like hex + * perf: hoist regular expressions + +2.2.0 / 2015-11-13 +================== + + * add option "decimalPlaces" + * add option "fixedDecimals" + +2.1.0 / 2015-05-21 +================== + + * add `.format` export + * add `.parse` export + +2.0.2 / 2015-05-20 +================== + + * remove map recreation + * remove unnecessary object construction + +2.0.1 / 2015-05-07 +================== + + * fix browserify require + * remove node.extend dependency + +2.0.0 / 2015-04-12 +================== + + * add option "case" + * add option "thousandsSeparator" + * return "null" on invalid parse input + * support proper round-trip: bytes(bytes(num)) === num + * units no longer case sensitive when parsing + +1.0.0 / 2014-05-05 +================== + + * add negative support. fixes #6 + +0.3.0 / 2014-03-19 +================== + + * added terabyte support + +0.2.1 / 2013-04-01 +================== + + * add .component + +0.2.0 / 2012-10-28 +================== + + * bytes(200).should.eql('200b') + +0.1.0 / 2012-07-04 +================== + + * add bytes to string conversion [yields] diff --git a/src/Servers/ExpressServer/node_modules/bytes/LICENSE b/src/Servers/ExpressServer/node_modules/bytes/LICENSE new file mode 100644 index 0000000..63e95a9 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/bytes/LICENSE @@ -0,0 +1,23 @@ +(The MIT License) + +Copyright (c) 2012-2014 TJ Holowaychuk +Copyright (c) 2015 Jed Watson + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +'Software'), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/src/Servers/ExpressServer/node_modules/bytes/Readme.md b/src/Servers/ExpressServer/node_modules/bytes/Readme.md new file mode 100644 index 0000000..5790e23 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/bytes/Readme.md @@ -0,0 +1,152 @@ +# Bytes utility + +[![NPM Version][npm-image]][npm-url] +[![NPM Downloads][downloads-image]][downloads-url] +[![Build Status][ci-image]][ci-url] +[![Test Coverage][coveralls-image]][coveralls-url] + +Utility to parse a string bytes (ex: `1TB`) to bytes (`1099511627776`) and vice-versa. + +## Installation + +This is a [Node.js](https://nodejs.org/en/) module available through the +[npm registry](https://www.npmjs.com/). Installation is done using the +[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally): + +```bash +$ npm install bytes +``` + +## Usage + +```js +var bytes = require('bytes'); +``` + +#### bytes(number｜string value, [options]): number｜string｜null + +Default export function. Delegates to either `bytes.format` or `bytes.parse` based on the type of `value`. + +**Arguments** + +| Name | Type | Description | +|---------|----------|--------------------| +| value | `number`｜`string` | Number value to format or string value to parse | +| options | `Object` | Conversion options for `format` | + +**Returns** + +| Name | Type | Description | +|---------|------------------|-------------------------------------------------| +| results | `string`｜`number`｜`null` | Return null upon error. Numeric value in bytes, or string value otherwise. | + +**Example** + +```js +bytes(1024); +// output: '1KB' + +bytes('1KB'); +// output: 1024 +``` + +#### bytes.format(number value, [options]): string｜null + +Format the given value in bytes into a string. If the value is negative, it is kept as such. If it is a float, it is + rounded. + +**Arguments** + +| Name | Type | Description | +|---------|----------|--------------------| +| value | `number` | Value in bytes | +| options | `Object` | Conversion options | + +**Options** + +| Property | Type | Description | +|-------------------|--------|-----------------------------------------------------------------------------------------| +| decimalPlaces | `number`｜`null` | Maximum number of decimal places to include in output. Default value to `2`. | +| fixedDecimals | `boolean`｜`null` | Whether to always display the maximum number of decimal places. Default value to `false` | +| thousandsSeparator | `string`｜`null` | Example of values: `' '`, `','` and `'.'`... Default value to `''`. | +| unit | `string`｜`null` | The unit in which the result will be returned (B/KB/MB/GB/TB). Default value to `''` (which means auto detect). | +| unitSeparator | `string`｜`null` | Separator to use between number and unit. Default value to `''`. | + +**Returns** + +| Name | Type | Description | +|---------|------------------|-------------------------------------------------| +| results | `string`｜`null` | Return null upon error. String value otherwise. | + +**Example** + +```js +bytes.format(1024); +// output: '1KB' + +bytes.format(1000); +// output: '1000B' + +bytes.format(1000, {thousandsSeparator: ' '}); +// output: '1 000B' + +bytes.format(1024 * 1.7, {decimalPlaces: 0}); +// output: '2KB' + +bytes.format(1024, {unitSeparator: ' '}); +// output: '1 KB' +``` + +#### bytes.parse(string｜number value): number｜null + +Parse the string value into an integer in bytes. If no unit is given, or `value` +is a number, it is assumed the value is in bytes. + +Supported units and abbreviations are as follows and are case-insensitive: + + * `b` for bytes + * `kb` for kilobytes + * `mb` for megabytes + * `gb` for gigabytes + * `tb` for terabytes + * `pb` for petabytes + +The units are in powers of two, not ten. This means 1kb = 1024b according to this parser. + +**Arguments** + +| Name | Type | Description | +|---------------|--------|--------------------| +| value | `string`｜`number` | String to parse, or number in bytes. | + +**Returns** + +| Name | Type | Description | +|---------|-------------|-------------------------| +| results | `number`｜`null` | Return null upon error. Value in bytes otherwise. | + +**Example** + +```js +bytes.parse('1KB'); +// output: 1024 + +bytes.parse('1024'); +// output: 1024 + +bytes.parse(1024); +// output: 1024 +``` + +## License + +[MIT](LICENSE) + +[ci-image]: https://badgen.net/github/checks/visionmedia/bytes.js/master?label=ci +[ci-url]: https://github.com/visionmedia/bytes.js/actions?query=workflow%3Aci +[coveralls-image]: https://badgen.net/coveralls/c/github/visionmedia/bytes.js/master +[coveralls-url]: https://coveralls.io/r/visionmedia/bytes.js?branch=master +[downloads-image]: https://badgen.net/npm/dm/bytes +[downloads-url]: https://npmjs.org/package/bytes +[npm-image]: https://badgen.net/npm/v/bytes +[npm-url]: https://npmjs.org/package/bytes diff --git a/src/Servers/ExpressServer/node_modules/bytes/index.js b/src/Servers/ExpressServer/node_modules/bytes/index.js new file mode 100644 index 0000000..6f2d0f8 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/bytes/index.js @@ -0,0 +1,170 @@ +/*! + * bytes + * Copyright(c) 2012-2014 TJ Holowaychuk + * Copyright(c) 2015 Jed Watson + * MIT Licensed + */ + +'use strict'; + +/** + * Module exports. + * @public + */ + +module.exports = bytes; +module.exports.format = format; +module.exports.parse = parse; + +/** + * Module variables. + * @private + */ + +var formatThousandsRegExp = /\B(?=(\d{3})+(?!\d))/g; + +var formatDecimalsRegExp = /(?:\.0*|(\.[^0]+)0+)$/; + +var map = { + b: 1, + kb: 1 << 10, + mb: 1 << 20, + gb: 1 << 30, + tb: Math.pow(1024, 4), + pb: Math.pow(1024, 5), +}; + +var parseRegExp = /^((-|\+)?(\d+(?:\.\d+)?)) *(kb|mb|gb|tb|pb)$/i; + +/** + * Convert the given value in bytes into a string or parse to string to an integer in bytes. + * + * @param {string|number} value + * @param {{ + * case: [string], + * decimalPlaces: [number] + * fixedDecimals: [boolean] + * thousandsSeparator: [string] + * unitSeparator: [string] + * }} [options] bytes options. + * + * @returns {string|number|null} + */ + +function bytes(value, options) { + if (typeof value === 'string') { + return parse(value); + } + + if (typeof value === 'number') { + return format(value, options); + } + + return null; +} + +/** + * Format the given value in bytes into a string. + * + * If the value is negative, it is kept as such. If it is a float, + * it is rounded. + * + * @param {number} value + * @param {object} [options] + * @param {number} [options.decimalPlaces=2] + * @param {number} [options.fixedDecimals=false] + * @param {string} [options.thousandsSeparator=] + * @param {string} [options.unit=] + * @param {string} [options.unitSeparator=] + * + * @returns {string|null} + * @public + */ + +function format(value, options) { + if (!Number.isFinite(value)) { + return null; + } + + var mag = Math.abs(value); + var thousandsSeparator = (options && options.thousandsSeparator) || ''; + var unitSeparator = (options && options.unitSeparator) || ''; + var decimalPlaces = (options && options.decimalPlaces !== undefined) ? options.decimalPlaces : 2; + var fixedDecimals = Boolean(options && options.fixedDecimals); + var unit = (options && options.unit) || ''; + + if (!unit || !map[unit.toLowerCase()]) { + if (mag >= map.pb) { + unit = 'PB'; + } else if (mag >= map.tb) { + unit = 'TB'; + } else if (mag >= map.gb) { + unit = 'GB'; + } else if (mag >= map.mb) { + unit = 'MB'; + } else if (mag >= map.kb) { + unit = 'KB'; + } else { + unit = 'B'; + } + } + + var val = value / map[unit.toLowerCase()]; + var str = val.toFixed(decimalPlaces); + + if (!fixedDecimals) { + str = str.replace(formatDecimalsRegExp, '$1'); + } + + if (thousandsSeparator) { + str = str.split('.').map(function (s, i) { + return i === 0 + ? s.replace(formatThousandsRegExp, thousandsSeparator) + : s + }).join('.'); + } + + return str + unitSeparator + unit; +} + +/** + * Parse the string value into an integer in bytes. + * + * If no unit is given, it is assumed the value is in bytes. + * + * @param {number|string} val + * + * @returns {number|null} + * @public + */ + +function parse(val) { + if (typeof val === 'number' && !isNaN(val)) { + return val; + } + + if (typeof val !== 'string') { + return null; + } + + // Test if the string passed is valid + var results = parseRegExp.exec(val); + var floatValue; + var unit = 'b'; + + if (!results) { + // Nothing could be extracted from the given string + floatValue = parseInt(val, 10); + unit = 'b' + } else { + // Retrieve the value and the unit + floatValue = parseFloat(results[1]); + unit = results[4].toLowerCase(); + } + + if (isNaN(floatValue)) { + return null; + } + + return Math.floor(map[unit] * floatValue); +} diff --git a/src/Servers/ExpressServer/node_modules/bytes/package.json b/src/Servers/ExpressServer/node_modules/bytes/package.json new file mode 100644 index 0000000..f2b6a8b --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/bytes/package.json @@ -0,0 +1,42 @@ +{ + "name": "bytes", + "description": "Utility to parse a string bytes to bytes and vice-versa", + "version": "3.1.2", + "author": "TJ Holowaychuk (http://tjholowaychuk.com)", + "contributors": [ + "Jed Watson ", + "Théo FIDRY " + ], + "license": "MIT", + "keywords": [ + "byte", + "bytes", + "utility", + "parse", + "parser", + "convert", + "converter" + ], + "repository": "visionmedia/bytes.js", + "devDependencies": { + "eslint": "7.32.0", + "eslint-plugin-markdown": "2.2.1", + "mocha": "9.2.0", + "nyc": "15.1.0" + }, + "files": [ + "History.md", + "LICENSE", + "Readme.md", + "index.js" + ], + "engines": { + "node": ">= 0.8" + }, + "scripts": { + "lint": "eslint .", + "test": "mocha --check-leaks --reporter spec", + "test-ci": "nyc --reporter=lcov --reporter=text npm test", + "test-cov": "nyc --reporter=html --reporter=text npm test" + } +} diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.eslintrc b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.eslintrc new file mode 100644 index 0000000..201e859 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.eslintrc @@ -0,0 +1,17 @@ +{ + "root": true, + + "extends": "@ljharb", + + "rules": { + "func-name-matching": 0, + "id-length": 0, + "new-cap": [2, { + "capIsNewExceptions": [ + "GetIntrinsic", + ], + }], + "no-extra-parens": 0, + "no-magic-numbers": 0, + }, +} diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.github/FUNDING.yml b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.github/FUNDING.yml new file mode 100644 index 0000000..0011e9d --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.github/FUNDING.yml @@ -0,0 +1,12 @@ +# These are supported funding model platforms + +github: [ljharb] +patreon: # Replace with a single Patreon username +open_collective: # Replace with a single Open Collective username +ko_fi: # Replace with a single Ko-fi username +tidelift: npm/call-bind-apply-helpers +community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry +liberapay: # Replace with a single Liberapay username +issuehunt: # Replace with a single IssueHunt username +otechie: # Replace with a single Otechie username +custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'] diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.nycrc b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.nycrc new file mode 100644 index 0000000..bdd626c --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/.nycrc @@ -0,0 +1,9 @@ +{ + "all": true, + "check-coverage": false, + "reporter": ["text-summary", "text", "html", "json"], + "exclude": [ + "coverage", + "test" + ] +} diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/CHANGELOG.md b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/CHANGELOG.md new file mode 100644 index 0000000..2484942 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/CHANGELOG.md @@ -0,0 +1,30 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [v1.0.2](https://github.com/ljharb/call-bind-apply-helpers/compare/v1.0.1...v1.0.2) - 2025-02-12 + +### Commits + +- [types] improve inferred types [`e6f9586`](https://github.com/ljharb/call-bind-apply-helpers/commit/e6f95860a3c72879cb861a858cdfb8138fbedec1) +- [Dev Deps] update `@arethetypeswrong/cli`, `@ljharb/tsconfig`, `@types/tape`, `es-value-fixtures`, `for-each`, `has-strict-mode`, `object-inspect` [`e43d540`](https://github.com/ljharb/call-bind-apply-helpers/commit/e43d5409f97543bfbb11f345d47d8ce4e066d8c1) + +## [v1.0.1](https://github.com/ljharb/call-bind-apply-helpers/compare/v1.0.0...v1.0.1) - 2024-12-08 + +### Commits + +- [types] `reflectApply`: fix types [`4efc396`](https://github.com/ljharb/call-bind-apply-helpers/commit/4efc3965351a4f02cc55e836fa391d3d11ef2ef8) +- [Fix] `reflectApply`: oops, Reflect is not a function [`83cc739`](https://github.com/ljharb/call-bind-apply-helpers/commit/83cc7395de6b79b7730bdf092f1436f0b1263c75) +- [Dev Deps] update `@arethetypeswrong/cli` [`80bd5d3`](https://github.com/ljharb/call-bind-apply-helpers/commit/80bd5d3ae58b4f6b6995ce439dd5a1bcb178a940) + +## v1.0.0 - 2024-12-05 + +### Commits + +- Initial implementation, tests, readme [`7879629`](https://github.com/ljharb/call-bind-apply-helpers/commit/78796290f9b7430c9934d6f33d94ae9bc89fce04) +- Initial commit [`3f1dc16`](https://github.com/ljharb/call-bind-apply-helpers/commit/3f1dc164afc43285631b114a5f9dd9137b2b952f) +- npm init [`081df04`](https://github.com/ljharb/call-bind-apply-helpers/commit/081df048c312fcee400922026f6e97281200a603) +- Only apps should have lockfiles [`5b9ca0f`](https://github.com/ljharb/call-bind-apply-helpers/commit/5b9ca0fe8101ebfaf309c549caac4e0a017ed930) diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/LICENSE b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/LICENSE new file mode 100644 index 0000000..f82f389 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2024 Jordan Harband + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/README.md b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/README.md new file mode 100644 index 0000000..8fc0dae --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/README.md @@ -0,0 +1,62 @@ +# call-bind-apply-helpers [![Version Badge][npm-version-svg]][package-url] + +[![github actions][actions-image]][actions-url] +[![coverage][codecov-image]][codecov-url] +[![dependency status][deps-svg]][deps-url] +[![dev dependency status][dev-deps-svg]][dev-deps-url] +[![License][license-image]][license-url] +[![Downloads][downloads-image]][downloads-url] + +[![npm badge][npm-badge-png]][package-url] + +Helper functions around Function call/apply/bind, for use in `call-bind`. + +The only packages that should likely ever use this package directly are `call-bind` and `get-intrinsic`. +Please use `call-bind` unless you have a very good reason not to. + +## Getting started + +```sh +npm install --save call-bind-apply-helpers +``` + +## Usage/Examples + +```js +const assert = require('assert'); +const callBindBasic = require('call-bind-apply-helpers'); + +function f(a, b) { + assert.equal(this, 1); + assert.equal(a, 2); + assert.equal(b, 3); + assert.equal(arguments.length, 2); +} + +const fBound = callBindBasic([f, 1]); + +delete Function.prototype.call; +delete Function.prototype.bind; + +fBound(2, 3); +``` + +## Tests + +Clone the repo, `npm install`, and run `npm test` + +[package-url]: https://npmjs.org/package/call-bind-apply-helpers +[npm-version-svg]: https://versionbadg.es/ljharb/call-bind-apply-helpers.svg +[deps-svg]: https://david-dm.org/ljharb/call-bind-apply-helpers.svg +[deps-url]: https://david-dm.org/ljharb/call-bind-apply-helpers +[dev-deps-svg]: https://david-dm.org/ljharb/call-bind-apply-helpers/dev-status.svg +[dev-deps-url]: https://david-dm.org/ljharb/call-bind-apply-helpers#info=devDependencies +[npm-badge-png]: https://nodei.co/npm/call-bind-apply-helpers.png?downloads=true&stars=true +[license-image]: https://img.shields.io/npm/l/call-bind-apply-helpers.svg +[license-url]: LICENSE +[downloads-image]: https://img.shields.io/npm/dm/call-bind-apply-helpers.svg +[downloads-url]: https://npm-stat.com/charts.html?package=call-bind-apply-helpers +[codecov-image]: https://codecov.io/gh/ljharb/call-bind-apply-helpers/branch/main/graphs/badge.svg +[codecov-url]: https://app.codecov.io/gh/ljharb/call-bind-apply-helpers/ +[actions-image]: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/call-bind-apply-helpers +[actions-url]: https://github.com/ljharb/call-bind-apply-helpers/actions diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/actualApply.d.ts b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/actualApply.d.ts new file mode 100644 index 0000000..b87286a --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/actualApply.d.ts @@ -0,0 +1 @@ +export = Reflect.apply; \ No newline at end of file diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/actualApply.js b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/actualApply.js new file mode 100644 index 0000000..ffa5135 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/actualApply.js @@ -0,0 +1,10 @@ +'use strict'; + +var bind = require('function-bind'); + +var $apply = require('./functionApply'); +var $call = require('./functionCall'); +var $reflectApply = require('./reflectApply'); + +/** @type {import('./actualApply')} */ +module.exports = $reflectApply || bind.call($call, $apply); diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/applyBind.d.ts b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/applyBind.d.ts new file mode 100644 index 0000000..d176c1a --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/applyBind.d.ts @@ -0,0 +1,19 @@ +import actualApply from './actualApply'; + +type TupleSplitHead = T['length'] extends N + ? T + : T extends [...infer R, any] + ? TupleSplitHead + : never + +type TupleSplitTail = O['length'] extends N + ? T + : T extends [infer F, ...infer R] + ? TupleSplitTail<[...R], N, [...O, F]> + : never + +type TupleSplit = [TupleSplitHead, TupleSplitTail] + +declare function applyBind(...args: TupleSplit, 2>[1]): ReturnType; + +export = applyBind; \ No newline at end of file diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/applyBind.js b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/applyBind.js new file mode 100644 index 0000000..d2b7723 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/applyBind.js @@ -0,0 +1,10 @@ +'use strict'; + +var bind = require('function-bind'); +var $apply = require('./functionApply'); +var actualApply = require('./actualApply'); + +/** @type {import('./applyBind')} */ +module.exports = function applyBind() { + return actualApply(bind, $apply, arguments); +}; diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionApply.d.ts b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionApply.d.ts new file mode 100644 index 0000000..1f6e11b --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionApply.d.ts @@ -0,0 +1 @@ +export = Function.prototype.apply; \ No newline at end of file diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionApply.js b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionApply.js new file mode 100644 index 0000000..c71df9c --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionApply.js @@ -0,0 +1,4 @@ +'use strict'; + +/** @type {import('./functionApply')} */ +module.exports = Function.prototype.apply; diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionCall.d.ts b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionCall.d.ts new file mode 100644 index 0000000..15e93df --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionCall.d.ts @@ -0,0 +1 @@ +export = Function.prototype.call; \ No newline at end of file diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionCall.js b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionCall.js new file mode 100644 index 0000000..7a8d873 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/functionCall.js @@ -0,0 +1,4 @@ +'use strict'; + +/** @type {import('./functionCall')} */ +module.exports = Function.prototype.call; diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/index.d.ts b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/index.d.ts new file mode 100644 index 0000000..541516b --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/index.d.ts @@ -0,0 +1,64 @@ +type RemoveFromTuple< + Tuple extends readonly unknown[], + RemoveCount extends number, + Index extends 1[] = [] +> = Index["length"] extends RemoveCount + ? Tuple + : Tuple extends [infer First, ...infer Rest] + ? RemoveFromTuple + : Tuple; + +type ConcatTuples< + Prefix extends readonly unknown[], + Suffix extends readonly unknown[] +> = [...Prefix, ...Suffix]; + +type ExtractFunctionParams = T extends (this: infer TThis, ...args: infer P extends readonly unknown[]) => infer R + ? { thisArg: TThis; params: P; returnType: R } + : never; + +type BindFunction< + T extends (this: any, ...args: any[]) => any, + TThis, + TBoundArgs extends readonly unknown[], + ReceiverBound extends boolean +> = ExtractFunctionParams extends { + thisArg: infer OrigThis; + params: infer P extends readonly unknown[]; + returnType: infer R; +} + ? ReceiverBound extends true + ? (...args: RemoveFromTuple>) => R extends [OrigThis, ...infer Rest] + ? [TThis, ...Rest] // Replace `this` with `thisArg` + : R + : >>( + thisArg: U, + ...args: RemainingArgs + ) => R extends [OrigThis, ...infer Rest] + ? [U, ...ConcatTuples] // Preserve bound args in return type + : R + : never; + +declare function callBind< + const T extends (this: any, ...args: any[]) => any, + Extracted extends ExtractFunctionParams, + const TBoundArgs extends Partial & readonly unknown[], + const TThis extends Extracted["thisArg"] +>( + args: [fn: T, thisArg: TThis, ...boundArgs: TBoundArgs] +): BindFunction; + +declare function callBind< + const T extends (this: any, ...args: any[]) => any, + Extracted extends ExtractFunctionParams, + const TBoundArgs extends Partial & readonly unknown[] +>( + args: [fn: T, ...boundArgs: TBoundArgs] +): BindFunction; + +declare function callBind( + args: [fn: Exclude, ...rest: TArgs] +): never; + +// export as namespace callBind; +export = callBind; diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/index.js b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/index.js new file mode 100644 index 0000000..2f6dab4 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/index.js @@ -0,0 +1,15 @@ +'use strict'; + +var bind = require('function-bind'); +var $TypeError = require('es-errors/type'); + +var $call = require('./functionCall'); +var $actualApply = require('./actualApply'); + +/** @type {(args: [Function, thisArg?: unknown, ...args: unknown[]]) => Function} TODO FIXME, find a way to use import('.') */ +module.exports = function callBindBasic(args) { + if (args.length < 1 || typeof args[0] !== 'function') { + throw new $TypeError('a function is required'); + } + return $actualApply(bind, $call, args); +}; diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/package.json b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/package.json new file mode 100644 index 0000000..923b8be --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/package.json @@ -0,0 +1,85 @@ +{ + "name": "call-bind-apply-helpers", + "version": "1.0.2", + "description": "Helper functions around Function call/apply/bind, for use in `call-bind`", + "main": "index.js", + "exports": { + ".": "./index.js", + "./actualApply": "./actualApply.js", + "./applyBind": "./applyBind.js", + "./functionApply": "./functionApply.js", + "./functionCall": "./functionCall.js", + "./reflectApply": "./reflectApply.js", + "./package.json": "./package.json" + }, + "scripts": { + "prepack": "npmignore --auto --commentLines=auto", + "prepublish": "not-in-publish || npm run prepublishOnly", + "prepublishOnly": "safe-publish-latest", + "prelint": "evalmd README.md", + "lint": "eslint --ext=.js,.mjs .", + "postlint": "tsc -p . && attw -P", + "pretest": "npm run lint", + "tests-only": "nyc tape 'test/**/*.js'", + "test": "npm run tests-only", + "posttest": "npx npm@'>=10.2' audit --production", + "version": "auto-changelog && git add CHANGELOG.md", + "postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\"" + }, + "repository": { + "type": "git", + "url": "git+https://github.com/ljharb/call-bind-apply-helpers.git" + }, + "author": "Jordan Harband ", + "license": "MIT", + "bugs": { + "url": "https://github.com/ljharb/call-bind-apply-helpers/issues" + }, + "homepage": "https://github.com/ljharb/call-bind-apply-helpers#readme", + "dependencies": { + "es-errors": "^1.3.0", + "function-bind": "^1.1.2" + }, + "devDependencies": { + "@arethetypeswrong/cli": "^0.17.3", + "@ljharb/eslint-config": "^21.1.1", + "@ljharb/tsconfig": "^0.2.3", + "@types/for-each": "^0.3.3", + "@types/function-bind": "^1.1.10", + "@types/object-inspect": "^1.13.0", + "@types/tape": "^5.8.1", + "auto-changelog": "^2.5.0", + "encoding": "^0.1.13", + "es-value-fixtures": "^1.7.1", + "eslint": "=8.8.0", + "evalmd": "^0.0.19", + "for-each": "^0.3.5", + "has-strict-mode": "^1.1.0", + "in-publish": "^2.0.1", + "npmignore": "^0.3.1", + "nyc": "^10.3.2", + "object-inspect": "^1.13.4", + "safe-publish-latest": "^2.0.0", + "tape": "^5.9.0", + "typescript": "next" + }, + "testling": { + "files": "test/index.js" + }, + "auto-changelog": { + "output": "CHANGELOG.md", + "template": "keepachangelog", + "unreleased": false, + "commitLimit": false, + "backfillLimit": false, + "hideCredit": true + }, + "publishConfig": { + "ignore": [ + ".github/workflows" + ] + }, + "engines": { + "node": ">= 0.4" + } +} diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/reflectApply.d.ts b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/reflectApply.d.ts new file mode 100644 index 0000000..6b2ae76 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/reflectApply.d.ts @@ -0,0 +1,3 @@ +declare const reflectApply: false | typeof Reflect.apply; + +export = reflectApply; diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/reflectApply.js b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/reflectApply.js new file mode 100644 index 0000000..3d03caa --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/reflectApply.js @@ -0,0 +1,4 @@ +'use strict'; + +/** @type {import('./reflectApply')} */ +module.exports = typeof Reflect !== 'undefined' && Reflect && Reflect.apply; diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/test/index.js b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/test/index.js new file mode 100644 index 0000000..1cdc89e --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/test/index.js @@ -0,0 +1,63 @@ +'use strict'; + +var callBind = require('../'); +var hasStrictMode = require('has-strict-mode')(); +var forEach = require('for-each'); +var inspect = require('object-inspect'); +var v = require('es-value-fixtures'); + +var test = require('tape'); + +test('callBindBasic', function (t) { + forEach(v.nonFunctions, function (nonFunction) { + t['throws']( + // @ts-expect-error + function () { callBind([nonFunction]); }, + TypeError, + inspect(nonFunction) + ' is not a function' + ); + }); + + var sentinel = { sentinel: true }; + /** @type {(this: T, a: A, b: B) => [T | undefined, A, B]} */ + var func = function (a, b) { + // eslint-disable-next-line no-invalid-this + return [!hasStrictMode && this === global ? undefined : this, a, b]; + }; + t.equal(func.length, 2, 'original function length is 2'); + + /** type {(thisArg: unknown, a: number, b: number) => [unknown, number, number]} */ + var bound = callBind([func]); + /** type {((a: number, b: number) => [typeof sentinel, typeof a, typeof b])} */ + var boundR = callBind([func, sentinel]); + /** type {((b: number) => [typeof sentinel, number, typeof b])} */ + var boundArg = callBind([func, sentinel, /** @type {const} */ (1)]); + + // @ts-expect-error + t.deepEqual(bound(), [undefined, undefined, undefined], 'bound func with no args'); + + // @ts-expect-error + t.deepEqual(func(), [undefined, undefined, undefined], 'unbound func with too few args'); + // @ts-expect-error + t.deepEqual(bound(1, 2), [hasStrictMode ? 1 : Object(1), 2, undefined], 'bound func too few args'); + // @ts-expect-error + t.deepEqual(boundR(), [sentinel, undefined, undefined], 'bound func with receiver, with too few args'); + // @ts-expect-error + t.deepEqual(boundArg(), [sentinel, 1, undefined], 'bound func with receiver and arg, with too few args'); + + t.deepEqual(func(1, 2), [undefined, 1, 2], 'unbound func with right args'); + t.deepEqual(bound(1, 2, 3), [hasStrictMode ? 1 : Object(1), 2, 3], 'bound func with right args'); + t.deepEqual(boundR(1, 2), [sentinel, 1, 2], 'bound func with receiver, with right args'); + t.deepEqual(boundArg(2), [sentinel, 1, 2], 'bound func with receiver and arg, with right arg'); + + // @ts-expect-error + t.deepEqual(func(1, 2, 3), [undefined, 1, 2], 'unbound func with too many args'); + // @ts-expect-error + t.deepEqual(bound(1, 2, 3, 4), [hasStrictMode ? 1 : Object(1), 2, 3], 'bound func with too many args'); + // @ts-expect-error + t.deepEqual(boundR(1, 2, 3), [sentinel, 1, 2], 'bound func with receiver, with too many args'); + // @ts-expect-error + t.deepEqual(boundArg(2, 3), [sentinel, 1, 2], 'bound func with receiver and arg, with too many args'); + + t.end(); +}); diff --git a/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/tsconfig.json b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/tsconfig.json new file mode 100644 index 0000000..aef9993 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bind-apply-helpers/tsconfig.json @@ -0,0 +1,9 @@ +{ + "extends": "@ljharb/tsconfig", + "compilerOptions": { + "target": "es2021", + }, + "exclude": [ + "coverage", + ], +} \ No newline at end of file diff --git a/src/Servers/ExpressServer/node_modules/call-bound/.eslintrc b/src/Servers/ExpressServer/node_modules/call-bound/.eslintrc new file mode 100644 index 0000000..2612ed8 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/.eslintrc @@ -0,0 +1,13 @@ +{ + "root": true, + + "extends": "@ljharb", + + "rules": { + "new-cap": [2, { + "capIsNewExceptions": [ + "GetIntrinsic", + ], + }], + }, +} diff --git a/src/Servers/ExpressServer/node_modules/call-bound/.github/FUNDING.yml b/src/Servers/ExpressServer/node_modules/call-bound/.github/FUNDING.yml new file mode 100644 index 0000000..2a2a135 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/.github/FUNDING.yml @@ -0,0 +1,12 @@ +# These are supported funding model platforms + +github: [ljharb] +patreon: # Replace with a single Patreon username +open_collective: # Replace with a single Open Collective username +ko_fi: # Replace with a single Ko-fi username +tidelift: npm/call-bound +community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry +liberapay: # Replace with a single Liberapay username +issuehunt: # Replace with a single IssueHunt username +otechie: # Replace with a single Otechie username +custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'] diff --git a/src/Servers/ExpressServer/node_modules/call-bound/.nycrc b/src/Servers/ExpressServer/node_modules/call-bound/.nycrc new file mode 100644 index 0000000..bdd626c --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/.nycrc @@ -0,0 +1,9 @@ +{ + "all": true, + "check-coverage": false, + "reporter": ["text-summary", "text", "html", "json"], + "exclude": [ + "coverage", + "test" + ] +} diff --git a/src/Servers/ExpressServer/node_modules/call-bound/CHANGELOG.md b/src/Servers/ExpressServer/node_modules/call-bound/CHANGELOG.md new file mode 100644 index 0000000..8bde4e9 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/CHANGELOG.md @@ -0,0 +1,42 @@ +# Changelog + +All notable changes to this project will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [v1.0.4](https://github.com/ljharb/call-bound/compare/v1.0.3...v1.0.4) - 2025-03-03 + +### Commits + +- [types] improve types [`e648922`](https://github.com/ljharb/call-bound/commit/e6489222a9e54f350fbf952ceabe51fd8b6027ff) +- [Dev Deps] update `@arethetypeswrong/cli`, `@ljharb/tsconfig`, `@types/tape`, `es-value-fixtures`, `for-each`, `has-strict-mode`, `object-inspect` [`a42a5eb`](https://github.com/ljharb/call-bound/commit/a42a5ebe6c1b54fcdc7997c7dc64fdca9e936719) +- [Deps] update `call-bind-apply-helpers`, `get-intrinsic` [`f529eac`](https://github.com/ljharb/call-bound/commit/f529eac132404c17156bbc23ab2297a25d0f20b8) + +## [v1.0.3](https://github.com/ljharb/call-bound/compare/v1.0.2...v1.0.3) - 2024-12-15 + +### Commits + +- [Refactor] use `call-bind-apply-helpers` instead of `call-bind` [`5e0b134`](https://github.com/ljharb/call-bound/commit/5e0b13496df14fb7d05dae9412f088da8d3f75be) +- [Deps] update `get-intrinsic` [`41fc967`](https://github.com/ljharb/call-bound/commit/41fc96732a22c7b7e8f381f93ccc54bb6293be2e) +- [readme] fix example [`79a0137`](https://github.com/ljharb/call-bound/commit/79a0137723f7c6d09c9c05452bbf8d5efb5d6e49) +- [meta] add `sideEffects` flag [`08b07be`](https://github.com/ljharb/call-bound/commit/08b07be7f1c03f67dc6f3cdaf0906259771859f7) + +## [v1.0.2](https://github.com/ljharb/call-bound/compare/v1.0.1...v1.0.2) - 2024-12-10 + +### Commits + +- [Dev Deps] update `@arethetypeswrong/cli`, `@ljharb/tsconfig`, `gopd` [`e6a5ffe`](https://github.com/ljharb/call-bound/commit/e6a5ffe849368fe4f74dfd6cdeca1b9baa39e8d5) +- [Deps] update `call-bind`, `get-intrinsic` [`2aeb5b5`](https://github.com/ljharb/call-bound/commit/2aeb5b521dc2b2683d1345c753ea1161de2d1c14) +- [types] improve return type [`1a0c9fe`](https://github.com/ljharb/call-bound/commit/1a0c9fe3114471e7ca1f57d104e2efe713bb4871) + +## v1.0.1 - 2024-12-05 + +### Commits + +- Initial implementation, tests, readme, types [`6d94121`](https://github.com/ljharb/call-bound/commit/6d94121a9243602e506334069f7a03189fe3363d) +- Initial commit [`0eae867`](https://github.com/ljharb/call-bound/commit/0eae867334ea025c33e6e91cdecfc9df96680cf9) +- npm init [`71b2479`](https://github.com/ljharb/call-bound/commit/71b2479c6723e0b7d91a6b663613067e98b7b275) +- Only apps should have lockfiles [`c3754a9`](https://github.com/ljharb/call-bound/commit/c3754a949b7f9132b47e2d18c1729889736741eb) +- [actions] skip `npm ls` in node < 10 [`74275a5`](https://github.com/ljharb/call-bound/commit/74275a5186b8caf6309b6b97472bdcb0df4683a8) +- [Dev Deps] add missing peer dep [`1354de8`](https://github.com/ljharb/call-bound/commit/1354de8679413e4ae9c523d85f76fa7a5e032d97) diff --git a/src/Servers/ExpressServer/node_modules/call-bound/LICENSE b/src/Servers/ExpressServer/node_modules/call-bound/LICENSE new file mode 100644 index 0000000..f82f389 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2024 Jordan Harband + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/src/Servers/ExpressServer/node_modules/call-bound/README.md b/src/Servers/ExpressServer/node_modules/call-bound/README.md new file mode 100644 index 0000000..a44e43e --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/README.md @@ -0,0 +1,53 @@ +# call-bound [![Version Badge][npm-version-svg]][package-url] + +[![github actions][actions-image]][actions-url] +[![coverage][codecov-image]][codecov-url] +[![dependency status][deps-svg]][deps-url] +[![dev dependency status][dev-deps-svg]][dev-deps-url] +[![License][license-image]][license-url] +[![Downloads][downloads-image]][downloads-url] + +[![npm badge][npm-badge-png]][package-url] + +Robust call-bound JavaScript intrinsics, using `call-bind` and `get-intrinsic`. + +## Getting started + +```sh +npm install --save call-bound +``` + +## Usage/Examples + +```js +const assert = require('assert'); +const callBound = require('call-bound'); + +const slice = callBound('Array.prototype.slice'); + +delete Function.prototype.call; +delete Function.prototype.bind; +delete Array.prototype.slice; + +assert.deepEqual(slice([1, 2, 3, 4], 1, -1), [2, 3]); +``` + +## Tests + +Clone the repo, `npm install`, and run `npm test` + +[package-url]: https://npmjs.org/package/call-bound +[npm-version-svg]: https://versionbadg.es/ljharb/call-bound.svg +[deps-svg]: https://david-dm.org/ljharb/call-bound.svg +[deps-url]: https://david-dm.org/ljharb/call-bound +[dev-deps-svg]: https://david-dm.org/ljharb/call-bound/dev-status.svg +[dev-deps-url]: https://david-dm.org/ljharb/call-bound#info=devDependencies +[npm-badge-png]: https://nodei.co/npm/call-bound.png?downloads=true&stars=true +[license-image]: https://img.shields.io/npm/l/call-bound.svg +[license-url]: LICENSE +[downloads-image]: https://img.shields.io/npm/dm/call-bound.svg +[downloads-url]: https://npm-stat.com/charts.html?package=call-bound +[codecov-image]: https://codecov.io/gh/ljharb/call-bound/branch/main/graphs/badge.svg +[codecov-url]: https://app.codecov.io/gh/ljharb/call-bound/ +[actions-image]: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/call-bound +[actions-url]: https://github.com/ljharb/call-bound/actions diff --git a/src/Servers/ExpressServer/node_modules/call-bound/index.d.ts b/src/Servers/ExpressServer/node_modules/call-bound/index.d.ts new file mode 100644 index 0000000..5562f00 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/index.d.ts @@ -0,0 +1,94 @@ +type Intrinsic = typeof globalThis; + +type IntrinsicName = keyof Intrinsic | `%${keyof Intrinsic}%`; + +type IntrinsicPath = IntrinsicName | `${StripPercents}.${string}` | `%${StripPercents}.${string}%`; + +type AllowMissing = boolean; + +type StripPercents = T extends `%${infer U}%` ? U : T; + +type BindMethodPrecise = + F extends (this: infer This, ...args: infer Args) => infer R + ? (obj: This, ...args: Args) => R + : F extends { + (this: infer This1, ...args: infer Args1): infer R1; + (this: infer This2, ...args: infer Args2): infer R2 + } + ? { + (obj: This1, ...args: Args1): R1; + (obj: This2, ...args: Args2): R2 + } + : never + +// Extract method type from a prototype +type GetPrototypeMethod = + (typeof globalThis)[T] extends { prototype: any } + ? M extends keyof (typeof globalThis)[T]['prototype'] + ? (typeof globalThis)[T]['prototype'][M] + : never + : never + +// Get static property/method +type GetStaticMember = + P extends keyof (typeof globalThis)[T] ? (typeof globalThis)[T][P] : never + +// Type that maps string path to actual bound function or value with better precision +type BoundIntrinsic = + S extends `${infer Obj}.prototype.${infer Method}` + ? Obj extends keyof typeof globalThis + ? BindMethodPrecise> + : unknown + : S extends `${infer Obj}.${infer Prop}` + ? Obj extends keyof typeof globalThis + ? GetStaticMember + : unknown + : unknown + +declare function arraySlice(array: readonly T[], start?: number, end?: number): T[]; +declare function arraySlice(array: ArrayLike, start?: number, end?: number): T[]; +declare function arraySlice(array: IArguments, start?: number, end?: number): T[]; + +// Special cases for methods that need explicit typing +interface SpecialCases { + '%Object.prototype.isPrototypeOf%': (thisArg: {}, obj: unknown) => boolean; + '%String.prototype.replace%': { + (str: string, searchValue: string | RegExp, replaceValue: string): string; + (str: string, searchValue: string | RegExp, replacer: (substring: string, ...args: any[]) => string): string + }; + '%Object.prototype.toString%': (obj: {}) => string; + '%Object.prototype.hasOwnProperty%': (obj: {}, v: PropertyKey) => boolean; + '%Array.prototype.slice%': typeof arraySlice; + '%Array.prototype.map%': (array: readonly T[], callbackfn: (value: T, index: number, array: readonly T[]) => U, thisArg?: any) => U[]; + '%Array.prototype.filter%': (array: readonly T[], predicate: (value: T, index: number, array: readonly T[]) => unknown, thisArg?: any) => T[]; + '%Array.prototype.indexOf%': (array: readonly T[], searchElement: T, fromIndex?: number) => number; + '%Function.prototype.apply%': (fn: (...args: A) => R, thisArg: any, args: A) => R; + '%Function.prototype.call%': (fn: (...args: A) => R, thisArg: any, ...args: A) => R; + '%Function.prototype.bind%': (fn: (...args: A) => R, thisArg: any, ...args: A) => (...remainingArgs: A) => R; + '%Promise.prototype.then%': { + (promise: Promise, onfulfilled: (value: T) => R | PromiseLike): Promise; + (promise: Promise, onfulfilled: ((value: T) => R | PromiseLike) | undefined | null, onrejected: (reason: any) => R | PromiseLike): Promise; + }; + '%RegExp.prototype.test%': (regexp: RegExp, str: string) => boolean; + '%RegExp.prototype.exec%': (regexp: RegExp, str: string) => RegExpExecArray | null; + '%Error.prototype.toString%': (error: Error) => string; + '%TypeError.prototype.toString%': (error: TypeError) => string; + '%String.prototype.split%': ( + obj: unknown, + splitter: string | RegExp | { + [Symbol.split](string: string, limit?: number): string[]; + }, + limit?: number | undefined + ) => string[]; +} + +/** + * Returns a bound function for a prototype method, or a value for a static property. + * + * @param name - The name of the intrinsic (e.g. 'Array.prototype.slice') + * @param {AllowMissing} [allowMissing] - Whether to allow missing intrinsics (default: false) + */ +declare function callBound, S extends IntrinsicPath>(name: K, allowMissing?: AllowMissing): SpecialCases[`%${StripPercents}%`]; +declare function callBound, S extends IntrinsicPath>(name: S, allowMissing?: AllowMissing): BoundIntrinsic; + +export = callBound; diff --git a/src/Servers/ExpressServer/node_modules/call-bound/index.js b/src/Servers/ExpressServer/node_modules/call-bound/index.js new file mode 100644 index 0000000..e9ade74 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/index.js @@ -0,0 +1,19 @@ +'use strict'; + +var GetIntrinsic = require('get-intrinsic'); + +var callBindBasic = require('call-bind-apply-helpers'); + +/** @type {(thisArg: string, searchString: string, position?: number) => number} */ +var $indexOf = callBindBasic([GetIntrinsic('%String.prototype.indexOf%')]); + +/** @type {import('.')} */ +module.exports = function callBoundIntrinsic(name, allowMissing) { + /* eslint no-extra-parens: 0 */ + + var intrinsic = /** @type {(this: unknown, ...args: unknown[]) => unknown} */ (GetIntrinsic(name, !!allowMissing)); + if (typeof intrinsic === 'function' && $indexOf(name, '.prototype.') > -1) { + return callBindBasic(/** @type {const} */ ([intrinsic])); + } + return intrinsic; +}; diff --git a/src/Servers/ExpressServer/node_modules/call-bound/package.json b/src/Servers/ExpressServer/node_modules/call-bound/package.json new file mode 100644 index 0000000..d542db4 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/package.json @@ -0,0 +1,99 @@ +{ + "name": "call-bound", + "version": "1.0.4", + "description": "Robust call-bound JavaScript intrinsics, using `call-bind` and `get-intrinsic`.", + "main": "index.js", + "exports": { + ".": "./index.js", + "./package.json": "./package.json" + }, + "sideEffects": false, + "scripts": { + "prepack": "npmignore --auto --commentLines=auto", + "prepublish": "not-in-publish || npm run prepublishOnly", + "prepublishOnly": "safe-publish-latest", + "prelint": "evalmd README.md", + "lint": "eslint --ext=.js,.mjs .", + "postlint": "tsc -p . && attw -P", + "pretest": "npm run lint", + "tests-only": "nyc tape 'test/**/*.js'", + "test": "npm run tests-only", + "posttest": "npx npm@'>=10.2' audit --production", + "version": "auto-changelog && git add CHANGELOG.md", + "postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\"" + }, + "repository": { + "type": "git", + "url": "git+https://github.com/ljharb/call-bound.git" + }, + "keywords": [ + "javascript", + "ecmascript", + "es", + "js", + "callbind", + "callbound", + "call", + "bind", + "bound", + "call-bind", + "call-bound", + "function", + "es-abstract" + ], + "author": "Jordan Harband ", + "funding": { + "url": "https://github.com/sponsors/ljharb" + }, + "license": "MIT", + "bugs": { + "url": "https://github.com/ljharb/call-bound/issues" + }, + "homepage": "https://github.com/ljharb/call-bound#readme", + "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "get-intrinsic": "^1.3.0" + }, + "devDependencies": { + "@arethetypeswrong/cli": "^0.17.4", + "@ljharb/eslint-config": "^21.1.1", + "@ljharb/tsconfig": "^0.3.0", + "@types/call-bind": "^1.0.5", + "@types/get-intrinsic": "^1.2.3", + "@types/tape": "^5.8.1", + "auto-changelog": "^2.5.0", + "encoding": "^0.1.13", + "es-value-fixtures": "^1.7.1", + "eslint": "=8.8.0", + "evalmd": "^0.0.19", + "for-each": "^0.3.5", + "gopd": "^1.2.0", + "has-strict-mode": "^1.1.0", + "in-publish": "^2.0.1", + "npmignore": "^0.3.1", + "nyc": "^10.3.2", + "object-inspect": "^1.13.4", + "safe-publish-latest": "^2.0.0", + "tape": "^5.9.0", + "typescript": "next" + }, + "testling": { + "files": "test/index.js" + }, + "auto-changelog": { + "output": "CHANGELOG.md", + "template": "keepachangelog", + "unreleased": false, + "commitLimit": false, + "backfillLimit": false, + "hideCredit": true + }, + "publishConfig": { + "ignore": [ + ".github/workflows" + ] + }, + "engines": { + "node": ">= 0.4" + } +} diff --git a/src/Servers/ExpressServer/node_modules/call-bound/test/index.js b/src/Servers/ExpressServer/node_modules/call-bound/test/index.js new file mode 100644 index 0000000..a2fc9f0 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/test/index.js @@ -0,0 +1,61 @@ +'use strict'; + +var test = require('tape'); + +var callBound = require('../'); + +/** @template {true} T @template U @typedef {T extends U ? T : never} AssertType */ + +test('callBound', function (t) { + // static primitive + t.equal(callBound('Array.length'), Array.length, 'Array.length yields itself'); + t.equal(callBound('%Array.length%'), Array.length, '%Array.length% yields itself'); + + // static non-function object + t.equal(callBound('Array.prototype'), Array.prototype, 'Array.prototype yields itself'); + t.equal(callBound('%Array.prototype%'), Array.prototype, '%Array.prototype% yields itself'); + t.equal(callBound('Array.constructor'), Array.constructor, 'Array.constructor yields itself'); + t.equal(callBound('%Array.constructor%'), Array.constructor, '%Array.constructor% yields itself'); + + // static function + t.equal(callBound('Date.parse'), Date.parse, 'Date.parse yields itself'); + t.equal(callBound('%Date.parse%'), Date.parse, '%Date.parse% yields itself'); + + // prototype primitive + t.equal(callBound('Error.prototype.message'), Error.prototype.message, 'Error.prototype.message yields itself'); + t.equal(callBound('%Error.prototype.message%'), Error.prototype.message, '%Error.prototype.message% yields itself'); + + var x = callBound('Object.prototype.toString'); + var y = callBound('%Object.prototype.toString%'); + + // prototype function + t.notEqual(x, Object.prototype.toString, 'Object.prototype.toString does not yield itself'); + t.notEqual(y, Object.prototype.toString, '%Object.prototype.toString% does not yield itself'); + t.equal(x(true), Object.prototype.toString.call(true), 'call-bound Object.prototype.toString calls into the original'); + t.equal(y(true), Object.prototype.toString.call(true), 'call-bound %Object.prototype.toString% calls into the original'); + + t['throws']( + // @ts-expect-error + function () { callBound('does not exist'); }, + SyntaxError, + 'nonexistent intrinsic throws' + ); + t['throws']( + // @ts-expect-error + function () { callBound('does not exist', true); }, + SyntaxError, + 'allowMissing arg still throws for unknown intrinsic' + ); + + t.test('real but absent intrinsic', { skip: typeof WeakRef !== 'undefined' }, function (st) { + st['throws']( + function () { callBound('WeakRef'); }, + TypeError, + 'real but absent intrinsic throws' + ); + st.equal(callBound('WeakRef', true), undefined, 'allowMissing arg avoids exception'); + st.end(); + }); + + t.end(); +}); diff --git a/src/Servers/ExpressServer/node_modules/call-bound/tsconfig.json b/src/Servers/ExpressServer/node_modules/call-bound/tsconfig.json new file mode 100644 index 0000000..8976d98 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/call-bound/tsconfig.json @@ -0,0 +1,10 @@ +{ + "extends": "@ljharb/tsconfig", + "compilerOptions": { + "target": "ESNext", + "lib": ["es2024"], + }, + "exclude": [ + "coverage", + ], +} diff --git a/src/Servers/ExpressServer/node_modules/content-disposition/HISTORY.md b/src/Servers/ExpressServer/node_modules/content-disposition/HISTORY.md new file mode 100644 index 0000000..488effa --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/content-disposition/HISTORY.md @@ -0,0 +1,60 @@ +0.5.4 / 2021-12-10 +================== + + * deps: safe-buffer@5.2.1 + +0.5.3 / 2018-12-17 +================== + + * Use `safe-buffer` for improved Buffer API + +0.5.2 / 2016-12-08 +================== + + * Fix `parse` to accept any linear whitespace character + +0.5.1 / 2016-01-17 +================== + + * perf: enable strict mode + +0.5.0 / 2014-10-11 +================== + + * Add `parse` function + +0.4.0 / 2014-09-21 +================== + + * Expand non-Unicode `filename` to the full ISO-8859-1 charset + +0.3.0 / 2014-09-20 +================== + + * Add `fallback` option + * Add `type` option + +0.2.0 / 2014-09-19 +================== + + * Reduce ambiguity of file names with hex escape in buggy browsers + +0.1.2 / 2014-09-19 +================== + + * Fix periodic invalid Unicode filename header + +0.1.1 / 2014-09-19 +================== + + * Fix invalid characters appearing in `filename*` parameter + +0.1.0 / 2014-09-18 +================== + + * Make the `filename` argument optional + +0.0.0 / 2014-09-18 +================== + + * Initial release diff --git a/src/Servers/ExpressServer/node_modules/content-disposition/LICENSE b/src/Servers/ExpressServer/node_modules/content-disposition/LICENSE new file mode 100644 index 0000000..84441fb --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/content-disposition/LICENSE @@ -0,0 +1,22 @@ +(The MIT License) + +Copyright (c) 2014-2017 Douglas Christopher Wilson + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +'Software'), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/src/Servers/ExpressServer/node_modules/content-disposition/README.md b/src/Servers/ExpressServer/node_modules/content-disposition/README.md new file mode 100644 index 0000000..3a0bb05 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/content-disposition/README.md @@ -0,0 +1,142 @@ +# content-disposition + +[![NPM Version][npm-image]][npm-url] +[![NPM Downloads][downloads-image]][downloads-url] +[![Node.js Version][node-version-image]][node-version-url] +[![Build Status][github-actions-ci-image]][github-actions-ci-url] +[![Test Coverage][coveralls-image]][coveralls-url] + +Create and parse HTTP `Content-Disposition` header + +## Installation + +```sh +$ npm install content-disposition +``` + +## API + +```js +var contentDisposition = require('content-disposition') +``` + +### contentDisposition(filename, options) + +Create an attachment `Content-Disposition` header value using the given file name, +if supplied. The `filename` is optional and if no file name is desired, but you +want to specify `options`, set `filename` to `undefined`. + +```js +res.setHeader('Content-Disposition', contentDisposition('∫ maths.pdf')) +``` + +**note** HTTP headers are of the ISO-8859-1 character set. If you are writing this +header through a means different from `setHeader` in Node.js, you'll want to specify +the `'binary'` encoding in Node.js. + +#### Options + +`contentDisposition` accepts these properties in the options object. + +##### fallback + +If the `filename` option is outside ISO-8859-1, then the file name is actually +stored in a supplemental field for clients that support Unicode file names and +a ISO-8859-1 version of the file name is automatically generated. + +This specifies the ISO-8859-1 file name to override the automatic generation or +disables the generation all together, defaults to `true`. + + - A string will specify the ISO-8859-1 file name to use in place of automatic + generation. + - `false` will disable including a ISO-8859-1 file name and only include the + Unicode version (unless the file name is already ISO-8859-1). + - `true` will enable automatic generation if the file name is outside ISO-8859-1. + +If the `filename` option is ISO-8859-1 and this option is specified and has a +different value, then the `filename` option is encoded in the extended field +and this set as the fallback field, even though they are both ISO-8859-1. + +##### type + +Specifies the disposition type, defaults to `"attachment"`. This can also be +`"inline"`, or any other value (all values except inline are treated like +`attachment`, but can convey additional information if both parties agree to +it). The type is normalized to lower-case. + +### contentDisposition.parse(string) + +```js +var disposition = contentDisposition.parse('attachment; filename="EURO rates.txt"; filename*=UTF-8\'\'%e2%82%ac%20rates.txt') +``` + +Parse a `Content-Disposition` header string. This automatically handles extended +("Unicode") parameters by decoding them and providing them under the standard +parameter name. This will return an object with the following properties (examples +are shown for the string `'attachment; filename="EURO rates.txt"; filename*=UTF-8\'\'%e2%82%ac%20rates.txt'`): + + - `type`: The disposition type (always lower case). Example: `'attachment'` + + - `parameters`: An object of the parameters in the disposition (name of parameter + always lower case and extended versions replace non-extended versions). Example: + `{filename: "€ rates.txt"}` + +## Examples + +### Send a file for download + +```js +var contentDisposition = require('content-disposition') +var destroy = require('destroy') +var fs = require('fs') +var http = require('http') +var onFinished = require('on-finished') + +var filePath = '/path/to/public/plans.pdf' + +http.createServer(function onRequest (req, res) { + // set headers + res.setHeader('Content-Type', 'application/pdf') + res.setHeader('Content-Disposition', contentDisposition(filePath)) + + // send file + var stream = fs.createReadStream(filePath) + stream.pipe(res) + onFinished(res, function () { + destroy(stream) + }) +}) +``` + +## Testing + +```sh +$ npm test +``` + +## References + +- [RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1][rfc-2616] +- [RFC 5987: Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters][rfc-5987] +- [RFC 6266: Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)][rfc-6266] +- [Test Cases for HTTP Content-Disposition header field (RFC 6266) and the Encodings defined in RFCs 2047, 2231 and 5987][tc-2231] + +[rfc-2616]: https://tools.ietf.org/html/rfc2616 +[rfc-5987]: https://tools.ietf.org/html/rfc5987 +[rfc-6266]: https://tools.ietf.org/html/rfc6266 +[tc-2231]: http://greenbytes.de/tech/tc2231/ + +## License + +[MIT](LICENSE) + +[npm-image]: https://img.shields.io/npm/v/content-disposition.svg +[npm-url]: https://npmjs.org/package/content-disposition +[node-version-image]: https://img.shields.io/node/v/content-disposition.svg +[node-version-url]: https://nodejs.org/en/download +[coveralls-image]: https://img.shields.io/coveralls/jshttp/content-disposition.svg +[coveralls-url]: https://coveralls.io/r/jshttp/content-disposition?branch=master +[downloads-image]: https://img.shields.io/npm/dm/content-disposition.svg +[downloads-url]: https://npmjs.org/package/content-disposition +[github-actions-ci-image]: https://img.shields.io/github/workflow/status/jshttp/content-disposition/ci/master?label=ci +[github-actions-ci-url]: https://github.com/jshttp/content-disposition?query=workflow%3Aci diff --git a/src/Servers/ExpressServer/node_modules/content-disposition/index.js b/src/Servers/ExpressServer/node_modules/content-disposition/index.js new file mode 100644 index 0000000..ecec899 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/content-disposition/index.js @@ -0,0 +1,458 @@ +/*! + * content-disposition + * Copyright(c) 2014-2017 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module exports. + * @public + */ + +module.exports = contentDisposition +module.exports.parse = parse + +/** + * Module dependencies. + * @private + */ + +var basename = require('path').basename +var Buffer = require('safe-buffer').Buffer + +/** + * RegExp to match non attr-char, *after* encodeURIComponent (i.e. not including "%") + * @private + */ + +var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g // eslint-disable-line no-control-regex + +/** + * RegExp to match percent encoding escape. + * @private + */ + +var HEX_ESCAPE_REGEXP = /%[0-9A-Fa-f]{2}/ +var HEX_ESCAPE_REPLACE_REGEXP = /%([0-9A-Fa-f]{2})/g + +/** + * RegExp to match non-latin1 characters. + * @private + */ + +var NON_LATIN1_REGEXP = /[^\x20-\x7e\xa0-\xff]/g + +/** + * RegExp to match quoted-pair in RFC 2616 + * + * quoted-pair = "\" CHAR + * CHAR = + * @private + */ + +var QESC_REGEXP = /\\([\u0000-\u007f])/g // eslint-disable-line no-control-regex + +/** + * RegExp to match chars that must be quoted-pair in RFC 2616 + * @private + */ + +var QUOTE_REGEXP = /([\\"])/g + +/** + * RegExp for various RFC 2616 grammar + * + * parameter = token "=" ( token | quoted-string ) + * token = 1* + * separators = "(" | ")" | "<" | ">" | "@" + * | "," | ";" | ":" | "\" | <"> + * | "/" | "[" | "]" | "?" | "=" + * | "{" | "}" | SP | HT + * quoted-string = ( <"> *(qdtext | quoted-pair ) <"> ) + * qdtext = > + * quoted-pair = "\" CHAR + * CHAR = + * TEXT = + * LWS = [CRLF] 1*( SP | HT ) + * CRLF = CR LF + * CR = + * LF = + * SP = + * HT = + * CTL = + * OCTET = + * @private + */ + +var PARAM_REGEXP = /;[\x09\x20]*([!#$%&'*+.0-9A-Z^_`a-z|~-]+)[\x09\x20]*=[\x09\x20]*("(?:[\x20!\x23-\x5b\x5d-\x7e\x80-\xff]|\\[\x20-\x7e])*"|[!#$%&'*+.0-9A-Z^_`a-z|~-]+)[\x09\x20]*/g // eslint-disable-line no-control-regex +var TEXT_REGEXP = /^[\x20-\x7e\x80-\xff]+$/ +var TOKEN_REGEXP = /^[!#$%&'*+.0-9A-Z^_`a-z|~-]+$/ + +/** + * RegExp for various RFC 5987 grammar + * + * ext-value = charset "'" [ language ] "'" value-chars + * charset = "UTF-8" / "ISO-8859-1" / mime-charset + * mime-charset = 1*mime-charsetc + * mime-charsetc = ALPHA / DIGIT + * / "!" / "#" / "$" / "%" / "&" + * / "+" / "-" / "^" / "_" / "`" + * / "{" / "}" / "~" + * language = ( 2*3ALPHA [ extlang ] ) + * / 4ALPHA + * / 5*8ALPHA + * extlang = *3( "-" 3ALPHA ) + * value-chars = *( pct-encoded / attr-char ) + * pct-encoded = "%" HEXDIG HEXDIG + * attr-char = ALPHA / DIGIT + * / "!" / "#" / "$" / "&" / "+" / "-" / "." + * / "^" / "_" / "`" / "|" / "~" + * @private + */ + +var EXT_VALUE_REGEXP = /^([A-Za-z0-9!#$%&+\-^_`{}~]+)'(?:[A-Za-z]{2,3}(?:-[A-Za-z]{3}){0,3}|[A-Za-z]{4,8}|)'((?:%[0-9A-Fa-f]{2}|[A-Za-z0-9!#$&+.^_`|~-])+)$/ + +/** + * RegExp for various RFC 6266 grammar + * + * disposition-type = "inline" | "attachment" | disp-ext-type + * disp-ext-type = token + * disposition-parm = filename-parm | disp-ext-parm + * filename-parm = "filename" "=" value + * | "filename*" "=" ext-value + * disp-ext-parm = token "=" value + * | ext-token "=" ext-value + * ext-token = + * @private + */ + +var DISPOSITION_TYPE_REGEXP = /^([!#$%&'*+.0-9A-Z^_`a-z|~-]+)[\x09\x20]*(?:$|;)/ // eslint-disable-line no-control-regex + +/** + * Create an attachment Content-Disposition header. + * + * @param {string} [filename] + * @param {object} [options] + * @param {string} [options.type=attachment] + * @param {string|boolean} [options.fallback=true] + * @return {string} + * @public + */ + +function contentDisposition (filename, options) { + var opts = options || {} + + // get type + var type = opts.type || 'attachment' + + // get parameters + var params = createparams(filename, opts.fallback) + + // format into string + return format(new ContentDisposition(type, params)) +} + +/** + * Create parameters object from filename and fallback. + * + * @param {string} [filename] + * @param {string|boolean} [fallback=true] + * @return {object} + * @private + */ + +function createparams (filename, fallback) { + if (filename === undefined) { + return + } + + var params = {} + + if (typeof filename !== 'string') { + throw new TypeError('filename must be a string') + } + + // fallback defaults to true + if (fallback === undefined) { + fallback = true + } + + if (typeof fallback !== 'string' && typeof fallback !== 'boolean') { + throw new TypeError('fallback must be a string or boolean') + } + + if (typeof fallback === 'string' && NON_LATIN1_REGEXP.test(fallback)) { + throw new TypeError('fallback must be ISO-8859-1 string') + } + + // restrict to file base name + var name = basename(filename) + + // determine if name is suitable for quoted string + var isQuotedString = TEXT_REGEXP.test(name) + + // generate fallback name + var fallbackName = typeof fallback !== 'string' + ? fallback && getlatin1(name) + : basename(fallback) + var hasFallback = typeof fallbackName === 'string' && fallbackName !== name + + // set extended filename parameter + if (hasFallback || !isQuotedString || HEX_ESCAPE_REGEXP.test(name)) { + params['filename*'] = name + } + + // set filename parameter + if (isQuotedString || hasFallback) { + params.filename = hasFallback + ? fallbackName + : name + } + + return params +} + +/** + * Format object to Content-Disposition header. + * + * @param {object} obj + * @param {string} obj.type + * @param {object} [obj.parameters] + * @return {string} + * @private + */ + +function format (obj) { + var parameters = obj.parameters + var type = obj.type + + if (!type || typeof type !== 'string' || !TOKEN_REGEXP.test(type)) { + throw new TypeError('invalid type') + } + + // start with normalized type + var string = String(type).toLowerCase() + + // append parameters + if (parameters && typeof parameters === 'object') { + var param + var params = Object.keys(parameters).sort() + + for (var i = 0; i < params.length; i++) { + param = params[i] + + var val = param.substr(-1) === '*' + ? ustring(parameters[param]) + : qstring(parameters[param]) + + string += '; ' + param + '=' + val + } + } + + return string +} + +/** + * Decode a RFC 5987 field value (gracefully). + * + * @param {string} str + * @return {string} + * @private + */ + +function decodefield (str) { + var match = EXT_VALUE_REGEXP.exec(str) + + if (!match) { + throw new TypeError('invalid extended field value') + } + + var charset = match[1].toLowerCase() + var encoded = match[2] + var value + + // to binary string + var binary = encoded.replace(HEX_ESCAPE_REPLACE_REGEXP, pdecode) + + switch (charset) { + case 'iso-8859-1': + value = getlatin1(binary) + break + case 'utf-8': + value = Buffer.from(binary, 'binary').toString('utf8') + break + default: + throw new TypeError('unsupported charset in extended field') + } + + return value +} + +/** + * Get ISO-8859-1 version of string. + * + * @param {string} val + * @return {string} + * @private + */ + +function getlatin1 (val) { + // simple Unicode -> ISO-8859-1 transformation + return String(val).replace(NON_LATIN1_REGEXP, '?') +} + +/** + * Parse Content-Disposition header string. + * + * @param {string} string + * @return {object} + * @public + */ + +function parse (string) { + if (!string || typeof string !== 'string') { + throw new TypeError('argument string is required') + } + + var match = DISPOSITION_TYPE_REGEXP.exec(string) + + if (!match) { + throw new TypeError('invalid type format') + } + + // normalize type + var index = match[0].length + var type = match[1].toLowerCase() + + var key + var names = [] + var params = {} + var value + + // calculate index to start at + index = PARAM_REGEXP.lastIndex = match[0].substr(-1) === ';' + ? index - 1 + : index + + // match parameters + while ((match = PARAM_REGEXP.exec(string))) { + if (match.index !== index) { + throw new TypeError('invalid parameter format') + } + + index += match[0].length + key = match[1].toLowerCase() + value = match[2] + + if (names.indexOf(key) !== -1) { + throw new TypeError('invalid duplicate parameter') + } + + names.push(key) + + if (key.indexOf('*') + 1 === key.length) { + // decode extended value + key = key.slice(0, -1) + value = decodefield(value) + + // overwrite existing value + params[key] = value + continue + } + + if (typeof params[key] === 'string') { + continue + } + + if (value[0] === '"') { + // remove quotes and escapes + value = value + .substr(1, value.length - 2) + .replace(QESC_REGEXP, '$1') + } + + params[key] = value + } + + if (index !== -1 && index !== string.length) { + throw new TypeError('invalid parameter format') + } + + return new ContentDisposition(type, params) +} + +/** + * Percent decode a single character. + * + * @param {string} str + * @param {string} hex + * @return {string} + * @private + */ + +function pdecode (str, hex) { + return String.fromCharCode(parseInt(hex, 16)) +} + +/** + * Percent encode a single character. + * + * @param {string} char + * @return {string} + * @private + */ + +function pencode (char) { + return '%' + String(char) + .charCodeAt(0) + .toString(16) + .toUpperCase() +} + +/** + * Quote a string for HTTP. + * + * @param {string} val + * @return {string} + * @private + */ + +function qstring (val) { + var str = String(val) + + return '"' + str.replace(QUOTE_REGEXP, '\\$1') + '"' +} + +/** + * Encode a Unicode string for HTTP (RFC 5987). + * + * @param {string} val + * @return {string} + * @private + */ + +function ustring (val) { + var str = String(val) + + // percent encode as UTF-8 + var encoded = encodeURIComponent(str) + .replace(ENCODE_URL_ATTR_CHAR_REGEXP, pencode) + + return 'UTF-8\'\'' + encoded +} + +/** + * Class for parsed Content-Disposition header for v8 optimization + * + * @public + * @param {string} type + * @param {object} parameters + * @constructor + */ + +function ContentDisposition (type, parameters) { + this.type = type + this.parameters = parameters +} diff --git a/src/Servers/ExpressServer/node_modules/content-disposition/package.json b/src/Servers/ExpressServer/node_modules/content-disposition/package.json new file mode 100644 index 0000000..43c70ce --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/content-disposition/package.json @@ -0,0 +1,44 @@ +{ + "name": "content-disposition", + "description": "Create and parse Content-Disposition header", + "version": "0.5.4", + "author": "Douglas Christopher Wilson ", + "license": "MIT", + "keywords": [ + "content-disposition", + "http", + "rfc6266", + "res" + ], + "repository": "jshttp/content-disposition", + "dependencies": { + "safe-buffer": "5.2.1" + }, + "devDependencies": { + "deep-equal": "1.0.1", + "eslint": "7.32.0", + "eslint-config-standard": "13.0.1", + "eslint-plugin-import": "2.25.3", + "eslint-plugin-markdown": "2.2.1", + "eslint-plugin-node": "11.1.0", + "eslint-plugin-promise": "5.2.0", + "eslint-plugin-standard": "4.1.0", + "istanbul": "0.4.5", + "mocha": "9.1.3" + }, + "files": [ + "LICENSE", + "HISTORY.md", + "README.md", + "index.js" + ], + "engines": { + "node": ">= 0.6" + }, + "scripts": { + "lint": "eslint .", + "test": "mocha --reporter spec --bail --check-leaks test/", + "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/", + "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/" + } +} diff --git a/src/Servers/ExpressServer/node_modules/content-type/HISTORY.md b/src/Servers/ExpressServer/node_modules/content-type/HISTORY.md new file mode 100644 index 0000000..4583671 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/content-type/HISTORY.md @@ -0,0 +1,29 @@ +1.0.5 / 2023-01-29 +================== + + * perf: skip value escaping when unnecessary + +1.0.4 / 2017-09-11 +================== + + * perf: skip parameter parsing when no parameters + +1.0.3 / 2017-09-10 +================== + + * perf: remove argument reassignment + +1.0.2 / 2016-05-09 +================== + + * perf: enable strict mode + +1.0.1 / 2015-02-13 +================== + + * Improve missing `Content-Type` header error message + +1.0.0 / 2015-02-01 +================== + + * Initial implementation, derived from `media-typer@0.3.0` diff --git a/src/Servers/ExpressServer/node_modules/content-type/LICENSE b/src/Servers/ExpressServer/node_modules/content-type/LICENSE new file mode 100644 index 0000000..34b1a2d --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/content-type/LICENSE @@ -0,0 +1,22 @@ +(The MIT License) + +Copyright (c) 2015 Douglas Christopher Wilson + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +'Software'), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/src/Servers/ExpressServer/node_modules/content-type/README.md b/src/Servers/ExpressServer/node_modules/content-type/README.md new file mode 100644 index 0000000..c1a922a --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/content-type/README.md @@ -0,0 +1,94 @@ +# content-type + +[![NPM Version][npm-version-image]][npm-url] +[![NPM Downloads][npm-downloads-image]][npm-url] +[![Node.js Version][node-image]][node-url] +[![Build Status][ci-image]][ci-url] +[![Coverage Status][coveralls-image]][coveralls-url] + +Create and parse HTTP Content-Type header according to RFC 7231 + +## Installation + +```sh +$ npm install content-type +``` + +## API + +```js +var contentType = require('content-type') +``` + +### contentType.parse(string) + +```js +var obj = contentType.parse('image/svg+xml; charset=utf-8') +``` + +Parse a `Content-Type` header. This will return an object with the following +properties (examples are shown for the string `'image/svg+xml; charset=utf-8'`): + + - `type`: The media type (the type and subtype, always lower case). + Example: `'image/svg+xml'` + + - `parameters`: An object of the parameters in the media type (name of parameter + always lower case). Example: `{charset: 'utf-8'}` + +Throws a `TypeError` if the string is missing or invalid. + +### contentType.parse(req) + +```js +var obj = contentType.parse(req) +``` + +Parse the `Content-Type` header from the given `req`. Short-cut for +`contentType.parse(req.headers['content-type'])`. + +Throws a `TypeError` if the `Content-Type` header is missing or invalid. + +### contentType.parse(res) + +```js +var obj = contentType.parse(res) +``` + +Parse the `Content-Type` header set on the given `res`. Short-cut for +`contentType.parse(res.getHeader('content-type'))`. + +Throws a `TypeError` if the `Content-Type` header is missing or invalid. + +### contentType.format(obj) + +```js +var str = contentType.format({ + type: 'image/svg+xml', + parameters: { charset: 'utf-8' } +}) +``` + +Format an object into a `Content-Type` header. This will return a string of the +content type for the given object with the following properties (examples are +shown that produce the string `'image/svg+xml; charset=utf-8'`): + + - `type`: The media type (will be lower-cased). Example: `'image/svg+xml'` + + - `parameters`: An object of the parameters in the media type (name of the + parameter will be lower-cased). Example: `{charset: 'utf-8'}` + +Throws a `TypeError` if the object contains an invalid type or parameter names. + +## License + +[MIT](LICENSE) + +[ci-image]: https://badgen.net/github/checks/jshttp/content-type/master?label=ci +[ci-url]: https://github.com/jshttp/content-type/actions/workflows/ci.yml +[coveralls-image]: https://badgen.net/coveralls/c/github/jshttp/content-type/master +[coveralls-url]: https://coveralls.io/r/jshttp/content-type?branch=master +[node-image]: https://badgen.net/npm/node/content-type +[node-url]: https://nodejs.org/en/download +[npm-downloads-image]: https://badgen.net/npm/dm/content-type +[npm-url]: https://npmjs.org/package/content-type +[npm-version-image]: https://badgen.net/npm/v/content-type diff --git a/src/Servers/ExpressServer/node_modules/content-type/index.js b/src/Servers/ExpressServer/node_modules/content-type/index.js new file mode 100644 index 0000000..41840e7 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/content-type/index.js @@ -0,0 +1,225 @@ +/*! + * content-type + * Copyright(c) 2015 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * RegExp to match *( ";" parameter ) in RFC 7231 sec 3.1.1.1 + * + * parameter = token "=" ( token / quoted-string ) + * token = 1*tchar + * tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" + * / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" + * / DIGIT / ALPHA + * ; any VCHAR, except delimiters + * quoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE + * qdtext = HTAB / SP / %x21 / %x23-5B / %x5D-7E / obs-text + * obs-text = %x80-FF + * quoted-pair = "\" ( HTAB / SP / VCHAR / obs-text ) + */ +var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g // eslint-disable-line no-control-regex +var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/ // eslint-disable-line no-control-regex +var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/ + +/** + * RegExp to match quoted-pair in RFC 7230 sec 3.2.6 + * + * quoted-pair = "\" ( HTAB / SP / VCHAR / obs-text ) + * obs-text = %x80-FF + */ +var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g // eslint-disable-line no-control-regex + +/** + * RegExp to match chars that must be quoted-pair in RFC 7230 sec 3.2.6 + */ +var QUOTE_REGEXP = /([\\"])/g + +/** + * RegExp to match type in RFC 7231 sec 3.1.1.1 + * + * media-type = type "/" subtype + * type = token + * subtype = token + */ +var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/ + +/** + * Module exports. + * @public + */ + +exports.format = format +exports.parse = parse + +/** + * Format object to media type. + * + * @param {object} obj + * @return {string} + * @public + */ + +function format (obj) { + if (!obj || typeof obj !== 'object') { + throw new TypeError('argument obj is required') + } + + var parameters = obj.parameters + var type = obj.type + + if (!type || !TYPE_REGEXP.test(type)) { + throw new TypeError('invalid type') + } + + var string = type + + // append parameters + if (parameters && typeof parameters === 'object') { + var param + var params = Object.keys(parameters).sort() + + for (var i = 0; i < params.length; i++) { + param = params[i] + + if (!TOKEN_REGEXP.test(param)) { + throw new TypeError('invalid parameter name') + } + + string += '; ' + param + '=' + qstring(parameters[param]) + } + } + + return string +} + +/** + * Parse media type to object. + * + * @param {string|object} string + * @return {Object} + * @public + */ + +function parse (string) { + if (!string) { + throw new TypeError('argument string is required') + } + + // support req/res-like objects as argument + var header = typeof string === 'object' + ? getcontenttype(string) + : string + + if (typeof header !== 'string') { + throw new TypeError('argument string is required to be a string') + } + + var index = header.indexOf(';') + var type = index !== -1 + ? header.slice(0, index).trim() + : header.trim() + + if (!TYPE_REGEXP.test(type)) { + throw new TypeError('invalid media type') + } + + var obj = new ContentType(type.toLowerCase()) + + // parse parameters + if (index !== -1) { + var key + var match + var value + + PARAM_REGEXP.lastIndex = index + + while ((match = PARAM_REGEXP.exec(header))) { + if (match.index !== index) { + throw new TypeError('invalid parameter format') + } + + index += match[0].length + key = match[1].toLowerCase() + value = match[2] + + if (value.charCodeAt(0) === 0x22 /* " */) { + // remove quotes + value = value.slice(1, -1) + + // remove escapes + if (value.indexOf('\\') !== -1) { + value = value.replace(QESC_REGEXP, '$1') + } + } + + obj.parameters[key] = value + } + + if (index !== header.length) { + throw new TypeError('invalid parameter format') + } + } + + return obj +} + +/** + * Get content-type from req/res objects. + * + * @param {object} + * @return {Object} + * @private + */ + +function getcontenttype (obj) { + var header + + if (typeof obj.getHeader === 'function') { + // res-like + header = obj.getHeader('content-type') + } else if (typeof obj.headers === 'object') { + // req-like + header = obj.headers && obj.headers['content-type'] + } + + if (typeof header !== 'string') { + throw new TypeError('content-type header is missing from object') + } + + return header +} + +/** + * Quote a string if necessary. + * + * @param {string} val + * @return {string} + * @private + */ + +function qstring (val) { + var str = String(val) + + // no need to quote tokens + if (TOKEN_REGEXP.test(str)) { + return str + } + + if (str.length > 0 && !TEXT_REGEXP.test(str)) { + throw new TypeError('invalid parameter value') + } + + return '"' + str.replace(QUOTE_REGEXP, '\\$1') + '"' +} + +/** + * Class to represent a content type. + * @private + */ +function ContentType (type) { + this.parameters = Object.create(null) + this.type = type +} diff --git a/src/Servers/ExpressServer/node_modules/content-type/package.json b/src/Servers/ExpressServer/node_modules/content-type/package.json new file mode 100644 index 0000000..9db19f6 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/content-type/package.json @@ -0,0 +1,42 @@ +{ + "name": "content-type", + "description": "Create and parse HTTP Content-Type header", + "version": "1.0.5", + "author": "Douglas Christopher Wilson ", + "license": "MIT", + "keywords": [ + "content-type", + "http", + "req", + "res", + "rfc7231" + ], + "repository": "jshttp/content-type", + "devDependencies": { + "deep-equal": "1.0.1", + "eslint": "8.32.0", + "eslint-config-standard": "15.0.1", + "eslint-plugin-import": "2.27.5", + "eslint-plugin-node": "11.1.0", + "eslint-plugin-promise": "6.1.1", + "eslint-plugin-standard": "4.1.0", + "mocha": "10.2.0", + "nyc": "15.1.0" + }, + "files": [ + "LICENSE", + "HISTORY.md", + "README.md", + "index.js" + ], + "engines": { + "node": ">= 0.6" + }, + "scripts": { + "lint": "eslint .", + "test": "mocha --reporter spec --check-leaks --bail test/", + "test-ci": "nyc --reporter=lcovonly --reporter=text npm test", + "test-cov": "nyc --reporter=html --reporter=text npm test", + "version": "node scripts/version-history.js && git add HISTORY.md" + } +} diff --git a/src/Servers/ExpressServer/node_modules/cookie-signature/History.md b/src/Servers/ExpressServer/node_modules/cookie-signature/History.md new file mode 100644 index 0000000..bcf8cc9 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/cookie-signature/History.md @@ -0,0 +1,42 @@ +1.0.7 / 2023-04-12 +================== + +* backport the buffer support from the 1.2.x release branch (thanks @FadhiliNjagi!) + +1.0.6 / 2015-02-03 +================== + +* use `npm test` instead of `make test` to run tests +* clearer assertion messages when checking input + +1.0.5 / 2014-09-05 +================== + +* add license to package.json + +1.0.4 / 2014-06-25 +================== + + * corrected avoidance of timing attacks (thanks @tenbits!) + +1.0.3 / 2014-01-28 +================== + + * [incorrect] fix for timing attacks + +1.0.2 / 2014-01-28 +================== + + * fix missing repository warning + * fix typo in test + +1.0.1 / 2013-04-15 +================== + + * Revert "Changed underlying HMAC algo. to sha512." + * Revert "Fix for timing attacks on MAC verification." + +0.0.1 / 2010-01-03 +================== + + * Initial release diff --git a/src/Servers/ExpressServer/node_modules/cookie-signature/Readme.md b/src/Servers/ExpressServer/node_modules/cookie-signature/Readme.md new file mode 100644 index 0000000..2559e84 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/cookie-signature/Readme.md @@ -0,0 +1,42 @@ + +# cookie-signature + + Sign and unsign cookies. + +## Example + +```js +var cookie = require('cookie-signature'); + +var val = cookie.sign('hello', 'tobiiscool'); +val.should.equal('hello.DGDUkGlIkCzPz+C0B064FNgHdEjox7ch8tOBGslZ5QI'); + +var val = cookie.sign('hello', 'tobiiscool'); +cookie.unsign(val, 'tobiiscool').should.equal('hello'); +cookie.unsign(val, 'luna').should.be.false; +``` + +## License + +(The MIT License) + +Copyright (c) 2012 LearnBoost <tj@learnboost.com> + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +'Software'), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. \ No newline at end of file diff --git a/src/Servers/ExpressServer/node_modules/cookie-signature/index.js b/src/Servers/ExpressServer/node_modules/cookie-signature/index.js new file mode 100644 index 0000000..336d487 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/cookie-signature/index.js @@ -0,0 +1,51 @@ +/** + * Module dependencies. + */ + +var crypto = require('crypto'); + +/** + * Sign the given `val` with `secret`. + * + * @param {String} val + * @param {String|NodeJS.ArrayBufferView|crypto.KeyObject} secret + * @return {String} + * @api private + */ + +exports.sign = function(val, secret){ + if ('string' !== typeof val) throw new TypeError("Cookie value must be provided as a string."); + if (null == secret) throw new TypeError("Secret key must be provided."); + return val + '.' + crypto + .createHmac('sha256', secret) + .update(val) + .digest('base64') + .replace(/\=+$/, ''); +}; + +/** + * Unsign and decode the given `val` with `secret`, + * returning `false` if the signature is invalid. + * + * @param {String} val + * @param {String|NodeJS.ArrayBufferView|crypto.KeyObject} secret + * @return {String|Boolean} + * @api private + */ + +exports.unsign = function(val, secret){ + if ('string' !== typeof val) throw new TypeError("Signed cookie string must be provided."); + if (null == secret) throw new TypeError("Secret key must be provided."); + var str = val.slice(0, val.lastIndexOf('.')) + , mac = exports.sign(str, secret); + + return sha1(mac) == sha1(val) ? str : false; +}; + +/** + * Private + */ + +function sha1(str){ + return crypto.createHash('sha1').update(str).digest('hex'); +} diff --git a/src/Servers/ExpressServer/node_modules/cookie-signature/package.json b/src/Servers/ExpressServer/node_modules/cookie-signature/package.json new file mode 100644 index 0000000..738487b --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/cookie-signature/package.json @@ -0,0 +1,18 @@ +{ + "name": "cookie-signature", + "version": "1.0.7", + "description": "Sign and unsign cookies", + "keywords": ["cookie", "sign", "unsign"], + "author": "TJ Holowaychuk ", + "license": "MIT", + "repository": { "type": "git", "url": "https://github.com/visionmedia/node-cookie-signature.git"}, + "dependencies": {}, + "devDependencies": { + "mocha": "*", + "should": "*" + }, + "scripts": { + "test": "mocha --require should --reporter spec" + }, + "main": "index" +} \ No newline at end of file diff --git a/src/Servers/ExpressServer/node_modules/cookie/LICENSE b/src/Servers/ExpressServer/node_modules/cookie/LICENSE new file mode 100644 index 0000000..058b6b4 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/cookie/LICENSE @@ -0,0 +1,24 @@ +(The MIT License) + +Copyright (c) 2012-2014 Roman Shtylman +Copyright (c) 2015 Douglas Christopher Wilson + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +'Software'), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. +IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY +CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, +TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE +SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + diff --git a/src/Servers/ExpressServer/node_modules/cookie/README.md b/src/Servers/ExpressServer/node_modules/cookie/README.md new file mode 100644 index 0000000..71fdac1 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/cookie/README.md @@ -0,0 +1,317 @@ +# cookie + +[![NPM Version][npm-version-image]][npm-url] +[![NPM Downloads][npm-downloads-image]][npm-url] +[![Node.js Version][node-image]][node-url] +[![Build Status][ci-image]][ci-url] +[![Coverage Status][coveralls-image]][coveralls-url] + +Basic HTTP cookie parser and serializer for HTTP servers. + +## Installation + +This is a [Node.js](https://nodejs.org/en/) module available through the +[npm registry](https://www.npmjs.com/). Installation is done using the +[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally): + +```sh +$ npm install cookie +``` + +## API + +```js +var cookie = require('cookie'); +``` + +### cookie.parse(str, options) + +Parse an HTTP `Cookie` header string and returning an object of all cookie name-value pairs. +The `str` argument is the string representing a `Cookie` header value and `options` is an +optional object containing additional parsing options. + +```js +var cookies = cookie.parse('foo=bar; equation=E%3Dmc%5E2'); +// { foo: 'bar', equation: 'E=mc^2' } +``` + +#### Options + +`cookie.parse` accepts these properties in the options object. + +##### decode + +Specifies a function that will be used to decode a cookie's value. Since the value of a cookie +has a limited character set (and must be a simple string), this function can be used to decode +a previously-encoded cookie value into a JavaScript string or other object. + +The default function is the global `decodeURIComponent`, which will decode any URL-encoded +sequences into their byte representations. + +**note** if an error is thrown from this function, the original, non-decoded cookie value will +be returned as the cookie's value. + +### cookie.serialize(name, value, options) + +Serialize a cookie name-value pair into a `Set-Cookie` header string. The `name` argument is the +name for the cookie, the `value` argument is the value to set the cookie to, and the `options` +argument is an optional object containing additional serialization options. + +```js +var setCookie = cookie.serialize('foo', 'bar'); +// foo=bar +``` + +#### Options + +`cookie.serialize` accepts these properties in the options object. + +##### domain + +Specifies the value for the [`Domain` `Set-Cookie` attribute][rfc-6265-5.2.3]. By default, no +domain is set, and most clients will consider the cookie to apply to only the current domain. + +##### encode + +Specifies a function that will be used to encode a cookie's value. Since value of a cookie +has a limited character set (and must be a simple string), this function can be used to encode +a value into a string suited for a cookie's value. + +The default function is the global `encodeURIComponent`, which will encode a JavaScript string +into UTF-8 byte sequences and then URL-encode any that fall outside of the cookie range. + +##### expires + +Specifies the `Date` object to be the value for the [`Expires` `Set-Cookie` attribute][rfc-6265-5.2.1]. +By default, no expiration is set, and most clients will consider this a "non-persistent cookie" and +will delete it on a condition like exiting a web browser application. + +**note** the [cookie storage model specification][rfc-6265-5.3] states that if both `expires` and +`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients by obey this, +so if both are set, they should point to the same date and time. + +##### httpOnly + +Specifies the `boolean` value for the [`HttpOnly` `Set-Cookie` attribute][rfc-6265-5.2.6]. When truthy, +the `HttpOnly` attribute is set, otherwise it is not. By default, the `HttpOnly` attribute is not set. + +**note** be careful when setting this to `true`, as compliant clients will not allow client-side +JavaScript to see the cookie in `document.cookie`. + +##### maxAge + +Specifies the `number` (in seconds) to be the value for the [`Max-Age` `Set-Cookie` attribute][rfc-6265-5.2.2]. +The given number will be converted to an integer by rounding down. By default, no maximum age is set. + +**note** the [cookie storage model specification][rfc-6265-5.3] states that if both `expires` and +`maxAge` are set, then `maxAge` takes precedence, but it is possible not all clients by obey this, +so if both are set, they should point to the same date and time. + +##### partitioned + +Specifies the `boolean` value for the [`Partitioned` `Set-Cookie`](rfc-cutler-httpbis-partitioned-cookies) +attribute. When truthy, the `Partitioned` attribute is set, otherwise it is not. By default, the +`Partitioned` attribute is not set. + +**note** This is an attribute that has not yet been fully standardized, and may change in the future. +This also means many clients may ignore this attribute until they understand it. + +More information about can be found in [the proposal](https://github.com/privacycg/CHIPS). + +##### path + +Specifies the value for the [`Path` `Set-Cookie` attribute][rfc-6265-5.2.4]. By default, the path +is considered the ["default path"][rfc-6265-5.1.4]. + +##### priority + +Specifies the `string` to be the value for the [`Priority` `Set-Cookie` attribute][rfc-west-cookie-priority-00-4.1]. + + - `'low'` will set the `Priority` attribute to `Low`. + - `'medium'` will set the `Priority` attribute to `Medium`, the default priority when not set. + - `'high'` will set the `Priority` attribute to `High`. + +More information about the different priority levels can be found in +[the specification][rfc-west-cookie-priority-00-4.1]. + +**note** This is an attribute that has not yet been fully standardized, and may change in the future. +This also means many clients may ignore this attribute until they understand it. + +##### sameSite + +Specifies the `boolean` or `string` to be the value for the [`SameSite` `Set-Cookie` attribute][rfc-6265bis-09-5.4.7]. + + - `true` will set the `SameSite` attribute to `Strict` for strict same site enforcement. + - `false` will not set the `SameSite` attribute. + - `'lax'` will set the `SameSite` attribute to `Lax` for lax same site enforcement. + - `'none'` will set the `SameSite` attribute to `None` for an explicit cross-site cookie. + - `'strict'` will set the `SameSite` attribute to `Strict` for strict same site enforcement. + +More information about the different enforcement levels can be found in +[the specification][rfc-6265bis-09-5.4.7]. + +**note** This is an attribute that has not yet been fully standardized, and may change in the future. +This also means many clients may ignore this attribute until they understand it. + +##### secure + +Specifies the `boolean` value for the [`Secure` `Set-Cookie` attribute][rfc-6265-5.2.5]. When truthy, +the `Secure` attribute is set, otherwise it is not. By default, the `Secure` attribute is not set. + +**note** be careful when setting this to `true`, as compliant clients will not send the cookie back to +the server in the future if the browser does not have an HTTPS connection. + +## Example + +The following example uses this module in conjunction with the Node.js core HTTP server +to prompt a user for their name and display it back on future visits. + +```js +var cookie = require('cookie'); +var escapeHtml = require('escape-html'); +var http = require('http'); +var url = require('url'); + +function onRequest(req, res) { + // Parse the query string + var query = url.parse(req.url, true, true).query; + + if (query && query.name) { + // Set a new cookie with the name + res.setHeader('Set-Cookie', cookie.serialize('name', String(query.name), { + httpOnly: true, + maxAge: 60 * 60 * 24 * 7 // 1 week + })); + + // Redirect back after setting cookie + res.statusCode = 302; + res.setHeader('Location', req.headers.referer || '/'); + res.end(); + return; + } + + // Parse the cookies on the request + var cookies = cookie.parse(req.headers.cookie || ''); + + // Get the visitor name set in the cookie + var name = cookies.name; + + res.setHeader('Content-Type', 'text/html; charset=UTF-8'); + + if (name) { + res.write('

Welcome back, ' + escapeHtml(name) + '!

'); + } else { + res.write('

Hello, new visitor!

'); + } + + res.write('
'); + res.write(' '); + res.end('
'); +} + +http.createServer(onRequest).listen(3000); +``` + +## Testing + +```sh +$ npm test +``` + +## Benchmark + +``` +$ npm run bench + +> cookie@0.5.0 bench +> node benchmark/index.js + + node@18.18.2 + acorn@8.10.0 + ada@2.6.0 + ares@1.19.1 + brotli@1.0.9 + cldr@43.1 + icu@73.2 + llhttp@6.0.11 + modules@108 + napi@9 + nghttp2@1.57.0 + nghttp3@0.7.0 + ngtcp2@0.8.1 + openssl@3.0.10+quic + simdutf@3.2.14 + tz@2023c + undici@5.26.3 + unicode@15.0 + uv@1.44.2 + uvwasi@0.0.18 + v8@10.2.154.26-node.26 + zlib@1.2.13.1-motley + +> node benchmark/parse-top.js + + cookie.parse - top sites + + 14 tests completed. + + parse accounts.google.com x 2,588,913 ops/sec ±0.74% (186 runs sampled) + parse apple.com x 2,370,002 ops/sec ±0.69% (186 runs sampled) + parse cloudflare.com x 2,213,102 ops/sec ±0.88% (188 runs sampled) + parse docs.google.com x 2,194,157 ops/sec ±1.03% (184 runs sampled) + parse drive.google.com x 2,265,084 ops/sec ±0.79% (187 runs sampled) + parse en.wikipedia.org x 457,099 ops/sec ±0.81% (186 runs sampled) + parse linkedin.com x 504,407 ops/sec ±0.89% (186 runs sampled) + parse maps.google.com x 1,230,959 ops/sec ±0.98% (186 runs sampled) + parse microsoft.com x 926,294 ops/sec ±0.88% (184 runs sampled) + parse play.google.com x 2,311,338 ops/sec ±0.83% (185 runs sampled) + parse support.google.com x 1,508,850 ops/sec ±0.86% (186 runs sampled) + parse www.google.com x 1,022,582 ops/sec ±1.32% (182 runs sampled) + parse youtu.be x 332,136 ops/sec ±1.02% (185 runs sampled) + parse youtube.com x 323,833 ops/sec ±0.77% (183 runs sampled) + +> node benchmark/parse.js + + cookie.parse - generic + + 6 tests completed. + + simple x 3,214,032 ops/sec ±1.61% (183 runs sampled) + decode x 587,237 ops/sec ±1.16% (187 runs sampled) + unquote x 2,954,618 ops/sec ±1.35% (183 runs sampled) + duplicates x 857,008 ops/sec ±0.89% (187 runs sampled) + 10 cookies x 292,133 ops/sec ±0.89% (187 runs sampled) + 100 cookies x 22,610 ops/sec ±0.68% (187 runs sampled) +``` + +## References + +- [RFC 6265: HTTP State Management Mechanism][rfc-6265] +- [Same-site Cookies][rfc-6265bis-09-5.4.7] + +[rfc-cutler-httpbis-partitioned-cookies]: https://tools.ietf.org/html/draft-cutler-httpbis-partitioned-cookies/ +[rfc-west-cookie-priority-00-4.1]: https://tools.ietf.org/html/draft-west-cookie-priority-00#section-4.1 +[rfc-6265bis-09-5.4.7]: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-09#section-5.4.7 +[rfc-6265]: https://tools.ietf.org/html/rfc6265 +[rfc-6265-5.1.4]: https://tools.ietf.org/html/rfc6265#section-5.1.4 +[rfc-6265-5.2.1]: https://tools.ietf.org/html/rfc6265#section-5.2.1 +[rfc-6265-5.2.2]: https://tools.ietf.org/html/rfc6265#section-5.2.2 +[rfc-6265-5.2.3]: https://tools.ietf.org/html/rfc6265#section-5.2.3 +[rfc-6265-5.2.4]: https://tools.ietf.org/html/rfc6265#section-5.2.4 +[rfc-6265-5.2.5]: https://tools.ietf.org/html/rfc6265#section-5.2.5 +[rfc-6265-5.2.6]: https://tools.ietf.org/html/rfc6265#section-5.2.6 +[rfc-6265-5.3]: https://tools.ietf.org/html/rfc6265#section-5.3 + +## License + +[MIT](LICENSE) + +[ci-image]: https://badgen.net/github/checks/jshttp/cookie/master?label=ci +[ci-url]: https://github.com/jshttp/cookie/actions/workflows/ci.yml +[coveralls-image]: https://badgen.net/coveralls/c/github/jshttp/cookie/master +[coveralls-url]: https://coveralls.io/r/jshttp/cookie?branch=master +[node-image]: https://badgen.net/npm/node/cookie +[node-url]: https://nodejs.org/en/download +[npm-downloads-image]: https://badgen.net/npm/dm/cookie +[npm-url]: https://npmjs.org/package/cookie +[npm-version-image]: https://badgen.net/npm/v/cookie diff --git a/src/Servers/ExpressServer/node_modules/cookie/SECURITY.md b/src/Servers/ExpressServer/node_modules/cookie/SECURITY.md new file mode 100644 index 0000000..fd4a6c5 --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/cookie/SECURITY.md @@ -0,0 +1,25 @@ +# Security Policies and Procedures + +## Reporting a Bug + +The `cookie` team and community take all security bugs seriously. Thank +you for improving the security of the project. We appreciate your efforts and +responsible disclosure and will make every effort to acknowledge your +contributions. + +Report security bugs by emailing the current owner(s) of `cookie`. This +information can be found in the npm registry using the command +`npm owner ls cookie`. +If unsure or unable to get the information from the above, open an issue +in the [project issue tracker](https://github.com/jshttp/cookie/issues) +asking for the current contact information. + +To ensure the timely response to your report, please ensure that the entirety +of the report is contained within the email body and not solely behind a web +link or an attachment. + +At least one owner will acknowledge your email within 48 hours, and will send a +more detailed response within 48 hours indicating the next steps in handling +your report. After the initial reply to your report, the owners will +endeavor to keep you informed of the progress towards a fix and full +announcement, and may ask for additional information or guidance. diff --git a/src/Servers/ExpressServer/node_modules/cookie/index.js b/src/Servers/ExpressServer/node_modules/cookie/index.js new file mode 100644 index 0000000..acd5acd --- /dev/null +++ b/src/Servers/ExpressServer/node_modules/cookie/index.js @@ -0,0 +1,335 @@ +/*! + * cookie + * Copyright(c) 2012-2014 Roman Shtylman + * Copyright(c) 2015 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict'; + +/** + * Module exports. + * @public + */ + +exports.parse = parse; +exports.serialize = serialize; + +/** + * Module variables. + * @private + */ + +var __toString = Object.prototype.toString +var __hasOwnProperty = Object.prototype.hasOwnProperty + +/** + * RegExp to match cookie-name in RFC 6265 sec 4.1.1 + * This refers out to the obsoleted definition of token in RFC 2616 sec 2.2 + * which has been replaced by the token definition in RFC 7230 appendix B. + * + * cookie-name = token + * token = 1*tchar + * tchar = "!" / "#" / "$" / "%" / "&" / "'" / + * "*" / "+" / "-" / "." / "^" / "_" / + * "`" / "|" / "~" / DIGIT / ALPHA + */ + +var cookieNameRegExp = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/; + +/** + * RegExp to match cookie-value in RFC 6265 sec 4.1.1 + * + * cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE ) + * cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E + * ; US-ASCII characters excluding CTLs, + * ; whitespace DQUOTE, comma, semicolon, + * ; and backslash + */ + +var cookieValueRegExp = /^("?)[\u0021\u0023-\u002B\u002D-\u003A\u003C-\u005B\u005D-\u007E]*\1$/; + +/** + * RegExp to match domain-value in RFC 6265 sec 4.1.1 + * + * domain-value = + * ; defined in [RFC1034], Section 3.5, as + * ; enhanced by [RFC1123], Section 2.1 + * =