Prevent chunk extension request smuggling

[erikdubbelboer]

Improve fuzzers to make sure our handling of http requests and responses is the same as net/http.

Thanks to https://github.com/xclow3n for reporting this!

[Copilot]

Pull request overview

Improves HTTP request/response parsing and fuzzing to better match Go’s net/http behavior and harden against chunk-extension based request smuggling.

Changes:

• Tightens chunk-size parsing to properly validate separators and safely skip chunk extensions.
• Enforces HTTP/1.1 Host requirement during request parsing and treats missing trailer terminators as broken chunks.
• Updates unit tests and fuzzers to include mandatory Host / valid status lines and to compare against net/http.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
http.go	Enforces Host for HTTP/1.1 requests, maps EOF-in-trailer to broken chunk, and hardens chunk-size parsing.
header.go	Tightens response/request first-line parsing (HTTP version and status code validation).
http_test.go	Adjusts request/response parsing tests for stricter parsing (valid status line, Host header) and multipart chunked formatting.
header_test.go	Updates response header tests (discard body between sequential responses; removes now-invalid “foobar” protocol test).
fuzz_test.go	Expands fuzzing to compare fasthttp body parsing against net/http under size limits.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.