Fix extra whitespace parsing in HTTP request lines to prevent cache poisoning (#2061)

* Initial plan

* Fix FastHTTP whitespace parsing issue - reject extra spaces in request lines

Co-authored-by: erikdubbelboer <[email protected]>

* Format header.go and header_test.go with gofmt

Co-authored-by: erikdubbelboer <[email protected]>

* Fix gofumpt formatting and mirror linting issues in header_test.go

Co-authored-by: erikdubbelboer <[email protected]>

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: erikdubbelboer <[email protected]>

Author: Copilot

header.go

@@ -2809,8 +2809,16 @@ func (h *RequestHeader) parseFirstLine(buf []byte) (int, error) {
 
 	b = b[n+1:]
 
-	// parse requestURI
-	n = bytes.LastIndexByte(b, ' ')
+	// Check for extra whitespace after method - only one space should separate method from URI
+	if len(b) > 0 && b[0] == ' ' {
+		if h.secureErrorLogMessage {
+			return 0, errors.New("extra whitespace in request line")
+		}
+		return 0, fmt.Errorf("extra whitespace in request line %q", buf)
+	}
+
+	// parse requestURI - RFC 9112 requires exactly one space between components
+	n = bytes.IndexByte(b, ' ')
 	if n < 0 {
 		return 0, fmt.Errorf("cannot find whitespace in the first line of request %q", buf)
 	} else if n == 0 {
@@ -2820,6 +2828,14 @@ func (h *RequestHeader) parseFirstLine(buf []byte) (int, error) {
 		return 0, fmt.Errorf("requestURI cannot be empty in %q", buf)
 	}
 
+	// Check for extra whitespace - only one space should separate URI from HTTP version
+	if n+1 < len(b) && b[n+1] == ' ' {
+		if h.secureErrorLogMessage {
+			return 0, errors.New("extra whitespace in request line")
+		}
+		return 0, fmt.Errorf("extra whitespace in request line %q", buf)
+	}
+
 	protoStr := b[n+1:]
 
 	// Follow RFCs 7230 and 9112 and require that HTTP versions match the following pattern: HTTP/[0-9]\.[0-9]

header_test.go

@@ -2934,9 +2934,8 @@ func TestRequestHeaderReadSuccess(t *testing.T) {
 	testRequestHeaderReadSuccess(t, h, "\r\n\n\r\nGET /aaa HTTP/1.1\r\nHost: aaa.com\r\n\r\nsss",
 		-2, "/aaa", "aaa.com", "", "")
 
-	// request uri with spaces
-	testRequestHeaderReadSuccess(t, h, "GET /foo/ bar baz HTTP/1.1\r\nHost: aa.com\r\n\r\nxxx",
-		-2, "/foo/ bar baz", "aa.com", "", "")
+	// request uri with spaces - should be rejected per RFC 9112
+	testRequestHeaderReadError(t, h, "GET /foo/ bar baz HTTP/1.1\r\nHost: aa.com\r\n\r\nxxx")
 
 	// no host
 	testRequestHeaderReadSuccess(t, h, "GET /foo/bar HTTP/1.1\r\nFOObar: assdfd\r\n\r\naaa",
@@ -3404,3 +3403,72 @@ func TestAddVaryHeaderExistingAcceptEncoding(t *testing.T) {
 		t.Errorf("Vary occurred %d times", n)
 	}
 }
+
+func TestRequestHeaderExtraWhitespace(t *testing.T) {
+	var h RequestHeader
+
+	// Test cases that should fail due to extra whitespace
+	testCases := []string{
+		"GET  /foo HTTP/1.1\r\nHost: example.com\r\n\r\n",    // Extra space after method
+		"GET   /foo HTTP/1.1\r\nHost: example.com\r\n\r\n",   // Multiple spaces after method
+		"GET /foo  HTTP/1.1\r\nHost: example.com\r\n\r\n",    // Extra space before HTTP version
+		"GET /foo   HTTP/1.1\r\nHost: example.com\r\n\r\n",   // Multiple spaces before HTTP version
+		"GET  /foo  HTTP/1.1\r\nHost: example.com\r\n\r\n",   // Extra spaces in both places
+		"GET   /foo   HTTP/1.1\r\nHost: example.com\r\n\r\n", // Multiple extra spaces in both places
+	}
+
+	for i, testCase := range testCases {
+		br := bufio.NewReader(bytes.NewBufferString(testCase))
+		err := h.Read(br)
+		if err == nil {
+			t.Errorf("Test case %d should have failed but didn't. Request: %q", i, testCase)
+		}
+		if !strings.Contains(err.Error(), "extra whitespace") {
+			t.Errorf("Test case %d should have failed with 'extra whitespace' error but got: %v", i, err)
+		}
+	}
+}
+
+func TestRequestHeaderValidWhitespace(t *testing.T) {
+	var h RequestHeader
+
+	// Test cases that should succeed (proper single space separation)
+	testCases := []struct {
+		request        string
+		expectedMethod string
+		expectedURI    string
+	}{
+		{
+			"GET /foo HTTP/1.1\r\nHost: example.com\r\n\r\n",
+			"GET",
+			"/foo",
+		},
+		{
+			"POST /api/v1/users HTTP/1.1\r\nHost: example.com\r\n\r\n",
+			"POST",
+			"/api/v1/users",
+		},
+		{
+			"PUT /resource HTTP/1.0\r\nHost: example.com\r\n\r\n",
+			"PUT",
+			"/resource",
+		},
+	}
+
+	for i, testCase := range testCases {
+		br := bufio.NewReader(bytes.NewBufferString(testCase.request))
+		err := h.Read(br)
+		if err != nil {
+			t.Errorf("Test case %d should have succeeded but failed with: %v. Request: %q", i, err, testCase.request)
+			continue
+		}
+
+		if string(h.Method()) != testCase.expectedMethod {
+			t.Errorf("Test case %d: expected method %q but got %q", i, testCase.expectedMethod, h.Method())
+		}
+
+		if string(h.RequestURI()) != testCase.expectedURI {
+			t.Errorf("Test case %d: expected URI %q but got %q", i, testCase.expectedURI, h.RequestURI())
+		}
+	}
+}