Testing & CI hardening phase 2: fuzz the HTTP/1.1 parser, even out malformed-server coverage (#48)

[aaylward]

What

Phase 2 of #48 (after #53), taking the two hostile-input items:

HTTP-parser fuzzing. The hand-rolled HTTP/1.1 message reader was the one network-facing parser with no fuzz coverage. It moves out of socket_transport.cc into a pure, callback-fed function (smithy/http/http1.h) behind the same transports — byte-for-byte behavior-preserving (all existing socket/hostile-framing tests pass unchanged). On top of it:

• //fuzz:http1_fuzz: a libFuzzer harness that replays wire bytes in varying chunk sizes so the incremental header/body accumulation paths get exercised, wired into the CI fuzz smoke loop and make fuzz-smoke (plus the deterministic //fuzz:http1_fuzz_smoke cc_test that runs in every bazel matrix job).
• http1_hostile_test.cc: a hostile bank at the pure-parser level — request-smuggling framing (duplicate/conflicting Content-Length, transfer-encoding, TE+CL), hostile content-lengths, malformed header blocks, an every-strict-prefix truncation property, header floods, the accept side (padding/case-insensitivity/body-until-EOF), and the start-line helpers. No sockets, so unlike socket_transport_hostile_test.cc it also runs on Windows.
• Hardening found while banking: an empty Content-Length and a +4-style signed one previously parsed as valid lengths (strtoull laxity); the parser now requires digits-only per RFC 9110.

Malformed-server evenness. Only jsonrpc2 had a malformed-server suite (its model carries httpMalformedRequestTests; the alloy and official rpcv2Cbor suites carry none). New hand-written suites — outside the golden generated/ trees, so the byte-identical regeneration check is untouched — pin the generated servers' reject paths before the handler runs:

• simpleRestJson (PizzaAdminService): 404/405 routing, unparseable JSON body → 400 + x-error-type: SerializationException, wrong content-type → 415, and the suite-exact enum-violation ValidationException message + fieldList path.
• The simpleRestJson @pattern-violation wire message Tracking: testing & CI hardening #48 explicitly called out as unasserted, via the roundtrip REST fixture's pattern-constrained SinkId — plus the exact length-violation message.
• rpcv2Cbor (RpcV2Protocol): missing/wrong smithy-protocol header → 400 SerializationException, wrong content-type → 415 UnsupportedMediaTypeException, truncated and non-map CBOR bodies → 400, 404/405 routing — asserting the CBOR __type and protocol headers on every error response.

Also: CI's clang-format check (and make lint/format) now covers protocol-tests outside generated/.

Remaining on #48: golden self-ratification, generator-class unit tests, union×{cbor, jsonRpc2} conformance cells, coverage tooling, benchmark gating, cross-platform sanitizers, executing-rule Bazel tests beyond the compile harness.

Testing

• bazel test //... green locally — 72 tests (up from 67: the http1 hostile bank, the http1 fuzz smoke, and the three malformed-server suites), with the Boost/Beast targets and //benchmarks/... excluded per docs/development.md's proxy note; CI covers those.
• A 15-second real-libFuzzer + ASan run of the new harness: 160k executions, no findings.
• The parser extraction is verified behavior-preserving by the pre-existing socket_transport_test and socket_transport_hostile_test (9 raw-socket framing attacks) passing unchanged.
• No Java changes; goldens untouched.

Checklist

• Tests added/updated for the change
• bazel test //... passes locally (Boost/benchmark targets excluded per docs; CI covers them); codegen untouched, gradle job unaffected
• Formatting clean (clang-format, buildifier; spotless N/A — no Java changes)
• Architectural decisions recorded as an ADR (not applicable — the parser extraction is an internal refactor with no consumer-facing surface change)

🤖 Generated with Claude Code

https://claude.ai/code/session_012VFUppN1idpmU1UrbHkknZ

---

Generated by Claude Code