@devicelab/maestro-runner-darwin-arm64 1.1.25 → 1.1.28

package/drivers/ios/WebDriverAgent/WebDriverAgentTests/IntegrationTests_watchOS/WDAWatchInProcessTestCase.swift

@@ -0,0 +1,51 @@
+/**
+ * Copyright (c) 2015-present, Facebook, Inc.
+ * All rights reserved.
+ *
+ * This source code is licensed under the BSD-style license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+import XCTest
+
+/// Base class for the watchOS integration tests: these call WebDriverAgentLib_watchOS's own
+/// categories directly (fb_descendantsMatchingClassName:, wdEnabled, fb_activeAppsInfo, etc.),
+/// the same way the iOS/tvOS integration tests do, rather than driving a separately running
+/// WebDriverAgentRunner_watchOS server over HTTP (see git history for that approach - dropped as
+/// not worth the added CI complexity; use the functional/e2e test suite for real-server coverage).
+class WDAWatchInProcessTestCase: XCTestCase {
+  static let integrationAppBundleId = ProcessInfo.processInfo.environment["WDA_TEST_BUNDLE_ID"]
+    ?? "com.facebook.wda.IntegrationApp.watchOS"
+
+  let app = XCUIApplication()
+
+  /// Override to return false for a suite whose tests are all pure reads that never mutate the
+  /// app's UI state (find, attributes, screenshots, source, ...) - the app then launches once for
+  /// the whole class instead of once per test method, which is significantly faster. Defaults to
+  /// true (relaunch every test) since that's the safe choice for any suite whose tests tap,
+  /// type, or otherwise change what's on screen - or depend on a specific starting state, like
+  /// resultLabel reading "Idle".
+  class var relaunchForEachTest: Bool { true }
+
+  // XCTest always runs one class's methods as a contiguous group, never interleaved with another
+  // class's - so "have we seen this class's ObjectIdentifier before" reliably means "is this the
+  // first test method of this class to run this session", regardless of test order randomization.
+  // Shared static storage keyed per-class, since a plain `static var` in the base class would be
+  // one slot shared by every subclass, not one per subclass.
+  private static var classesAlreadyLaunched = Set<ObjectIdentifier>()
+
+  override func setUp() {
+    super.setUp()
+    continueAfterFailure = false
+
+    let isFirstTestForThisClass = Self.classesAlreadyLaunched.insert(ObjectIdentifier(Self.self)).inserted
+    // Reuse the running app only if: this suite opted in, this isn't the class's first test
+    // (every class still gets one guaranteed-clean launch, regardless of what a previous class
+    // left on screen), and the isRunning check confirms the app didn't crash/background since.
+    let canReuseRunningApp = !Self.relaunchForEachTest && !isFirstTestForThisClass && app.state == .runningForeground
+    if !canReuseRunningApp {
+      app.launch()
+    }
+    XCTAssertTrue(app.buttons["tapMeButton"].waitForExistence(timeout: 15))
+  }
+}

package/drivers/ios/WebDriverAgent/WebDriverAgentTests/UnitTests/Doubles/XCUIElementDouble.h

@@ -31,6 +31,7 @@
 @property (nonatomic, readwrite) NSUInteger wdIndex;
 @property (nonatomic, readwrite, getter=isWDVisible) BOOL wdVisible;
 @property (nonatomic, readwrite, getter=isWDAccessible) BOOL wdAccessible;
+@property (nonatomic, readwrite, getter=isWDNativeAccessibilityElement) BOOL wdNativeAccessibilityElement;
 @property (nonatomic, readwrite, getter = isWDFocused) BOOL wdFocused;
 @property (nonatomic, readwrite, getter = isWDHittable) BOOL wdHittable;
 @property (nonatomic, copy, readwrite, nullable) NSString *wdPlaceholderValue;
@@ -44,8 +45,11 @@
 - (id _Nonnull)fb_standardSnapshot;
 - (id _Nonnull)fb_customSnapshot;
 - (nullable id)query;
+- (void)typeKey:(nonnull NSString *)key modifierFlags:(NSUInteger)modifierFlags;
 
 // Checks
 @property (nonatomic, assign, readonly) BOOL didResolve;
+@property (nonatomic, copy, readonly, nonnull) NSArray<NSString *> *typedKeys;
+@property (nonatomic, assign, readonly) NSUInteger lastTypedModifierFlags;
 
 @end

package/drivers/ios/WebDriverAgent/WebDriverAgentTests/UnitTests/Doubles/XCUIElementDouble.m

@@ -10,6 +10,8 @@
 
 @interface XCUIElementDouble ()
 @property (nonatomic, assign, readwrite) BOOL didResolve;
+@property (nonatomic, copy, readwrite, nonnull) NSArray<NSString *> *typedKeys;
+@property (nonatomic, assign, readwrite) NSUInteger lastTypedModifierFlags;
 @end
 
 @implementation XCUIElementDouble
@@ -28,6 +30,7 @@
     self.wdCustomActions = nil;
     self.wdVisible = YES;
     self.wdAccessible = YES;
+    self.wdNativeAccessibilityElement = YES;
     self.wdEnabled = YES;
     self.wdSelected = YES;
     self.wdFocused = YES;
@@ -47,10 +50,17 @@
     self.wdType = @"XCUIElementTypeOther";
     self.wdUID = @"0";
     self.lastSnapshot = nil;
+    self.typedKeys = @[];
   }
   return self;
 }
 
+- (void)typeKey:(NSString *)key modifierFlags:(NSUInteger)modifierFlags
+{
+  self.typedKeys = [self.typedKeys arrayByAddingObject:key];
+  self.lastTypedModifierFlags = modifierFlags;
+}
+
 - (id)fb_valueForWDAttributeName:(NSString *)name
 {
   return @"test";

package/drivers/ios/WebDriverAgent/WebDriverAgentTests/UnitTests/FBConfigurationTests.m

@@ -22,39 +22,51 @@
   unsetenv("USE_PORT");
   unsetenv("USE_IP");
   unsetenv("VERBOSE_LOGGING");
+  unsetenv("MAX_HTTP_REQUEST_BODY_SIZE");
 }
 
 - (void)testBindingPortDefault
 {
-  XCTAssertTrue(NSEqualRanges([FBConfiguration bindingPortRange], NSMakeRange(8100, 100)));
+  XCTAssertTrue(NSEqualRanges(FBConfiguration.sharedInstance.bindingPortRange, NSMakeRange(8100, 100)));
 }
 
 - (void)testBindingPortEnvironmentOverwrite
 {
   setenv("USE_PORT", "1000", 1);
-  XCTAssertTrue(NSEqualRanges([FBConfiguration bindingPortRange], NSMakeRange(1000, 1)));
+  XCTAssertTrue(NSEqualRanges(FBConfiguration.sharedInstance.bindingPortRange, NSMakeRange(1000, 1)));
 }
 
 - (void)testVerboseLoggingDefault
 {
-  XCTAssertFalse([FBConfiguration verboseLoggingEnabled]);
+  XCTAssertFalse(FBConfiguration.sharedInstance.verboseLoggingEnabled);
 }
 
 - (void)testVerboseLoggingEnvironmentOverwrite
 {
   setenv("VERBOSE_LOGGING", "YES", 1);
-  XCTAssertTrue([FBConfiguration verboseLoggingEnabled]);
+  XCTAssertTrue(FBConfiguration.sharedInstance.verboseLoggingEnabled);
 }
 
 - (void)testBindingIPDefault
 {
-  XCTAssertNil([FBConfiguration bindingIPAddress]);
+  XCTAssertNil(FBConfiguration.sharedInstance.bindingIPAddress);
 }
 
 - (void)testBindingIPEnvironmentOverwrite
 {
   setenv("USE_IP", "192.168.1.100", 1);
-  XCTAssertEqualObjects([FBConfiguration bindingIPAddress], @"192.168.1.100");
+  XCTAssertEqualObjects(FBConfiguration.sharedInstance.bindingIPAddress, @"192.168.1.100");
+}
+
+- (void)testHttpRequestBodySizeLimitDefault
+{
+  XCTAssertEqual(FBConfiguration.sharedInstance.httpRequestBodySizeLimit, 1024ull * 1024ull * 1024ull);
+}
+
+- (void)testHttpRequestBodySizeLimitEnvironmentOverwrite
+{
+  setenv("MAX_HTTP_REQUEST_BODY_SIZE", "1024", 1);
+  XCTAssertEqual(FBConfiguration.sharedInstance.httpRequestBodySizeLimit, 1024ull);
 }
 
 @end

package/drivers/ios/WebDriverAgent/WebDriverAgentTests/UnitTests/FBCustomCommandsTests.m

@@ -0,0 +1,83 @@
+/**
+ * Copyright (c) 2015-present, Facebook, Inc.
+ * All rights reserved.
+ *
+ * This source code is licensed under the BSD-style license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+#import <XCTest/XCTest.h>
+
+#import "FBCustomCommands.h"
+#import "FBElementCache.h"
+#import "FBRouteRequest-Private.h"
+#import "FBSession.h"
+#import "Doubles/XCUIElementDouble.h"
+
+#if !TARGET_OS_TV && __clang_major__ >= 15
+
+@interface FBCustomCommands (FBWDATestable)
++ (id<FBResponsePayload>)handleKeyboardInput:(FBRouteRequest *)request;
+@end
+
+@interface FBCustomCommandsTests : XCTestCase
+@property (nonatomic, strong) FBSession *session;
+@end
+
+@implementation FBCustomCommandsTests
+
+- (void)setUp
+{
+  [super setUp];
+  self.session = [FBSession initWithApplication:nil];
+}
+
+- (void)tearDown
+{
+  [self.session kill];
+  [super tearDown];
+}
+
+- (FBRouteRequest *)requestWithElement:(XCUIElementDouble *)element keys:(NSArray *)keys
+{
+  // uuid "0" is reserved by handleKeyboardInput: to mean "no element" (use the active application).
+  element.wdUID = @"1";
+  NSString *uuid = [self.session.elementCache storeElement:(XCUIElement *)element];
+  FBRouteRequest *request = [FBRouteRequest routeRequestWithURL:[NSURL URLWithString:@"http://localhost:8100/"]
+                                                       parameters:@{@"uuid": uuid}
+                                                        arguments:@{@"keys": keys}];
+  request.session = self.session;
+  return request;
+}
+
+- (void)testDictionaryKeyWithConstantNameIsResolved
+{
+  XCUIElementDouble *element = XCUIElementDouble.new;
+  FBRouteRequest *request = [self requestWithElement:element
+                                                 keys:@[@{@"key": @"XCUIKeyboardKeyTab"}]];
+  [FBCustomCommands handleKeyboardInput:request];
+  XCTAssertEqualObjects(element.typedKeys, @[XCUIKeyboardKeyTab]);
+}
+
+- (void)testDictionaryKeyWithLiteralCharacterIsPassedThrough
+{
+  XCUIElementDouble *element = XCUIElementDouble.new;
+  FBRouteRequest *request = [self requestWithElement:element
+                                                 keys:@[@{@"key": @"a"}]];
+  [FBCustomCommands handleKeyboardInput:request];
+  XCTAssertEqualObjects(element.typedKeys, @[@"a"]);
+}
+
+- (void)testDictionaryKeyWithConstantNameAndModifierFlagsIsResolved
+{
+  XCUIElementDouble *element = XCUIElementDouble.new;
+  FBRouteRequest *request = [self requestWithElement:element
+                                                 keys:@[@{@"key": @"XCUIKeyboardKeyTab", @"modifierFlags": @2}]];
+  [FBCustomCommands handleKeyboardInput:request];
+  XCTAssertEqualObjects(element.typedKeys, @[XCUIKeyboardKeyTab]);
+  XCTAssertEqual(element.lastTypedModifierFlags, 2);
+}
+
+@end
+
+#endif

package/drivers/ios/WebDriverAgent/WebDriverAgentTests/UnitTests/FBHTTPServerSessionTests.m

@@ -0,0 +1,133 @@
+/**
+ * Copyright (c) 2015-present, Facebook, Inc.
+ * All rights reserved.
+ *
+ * This source code is licensed under the BSD-style license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+#import <XCTest/XCTest.h>
+
+#import <arpa/inet.h>
+#import <stdatomic.h>
+#import <sys/socket.h>
+
+#import "FBHTTPServer.h"
+
+static atomic_int gSessionProbeHits;
+
+@interface FBHTTPServerSessionTests : XCTestCase
+@property (nonatomic, strong) FBHTTPServer *server;
+@property (nonatomic, assign) uint16_t port;
+@end
+
+@implementation FBHTTPServerSessionTests
+
+- (void)setUp
+{
+  [super setUp];
+  atomic_store(&gSessionProbeHits, 0);
+  self.server = [FBHTTPServer new];
+  [self.server get:@"/session/:sessionID/probe" withBlock:^(RouteRequest *request, RouteResponse *response) {
+    atomic_fetch_add(&gSessionProbeHits, 1);
+    [response respondWithString:@"session-probe-ok"];
+  }];
+  self.server.port = 0;
+  NSError *error;
+  XCTAssertTrue([self.server start:&error], @"%@", error);
+  self.port = [[self.server valueForKeyPath:@"socket.port"] unsignedShortValue];
+}
+
+- (void)tearDown
+{
+  [self.server stop:NO];
+  self.server = nil;
+  [super tearDown];
+}
+
+- (NSString *)responseForRawPayload:(NSData *)payload timeout:(NSTimeInterval)timeout
+{
+  int fd = socket(AF_INET, SOCK_STREAM, 0);
+  if (fd < 0) {
+    return nil;
+  }
+  int noSigpipe = 1;
+  setsockopt(fd, SOL_SOCKET, SO_NOSIGPIPE, &noSigpipe, sizeof(noSigpipe));
+  struct timeval tv = { .tv_sec = (long)timeout, .tv_usec = 0 };
+  setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+  struct sockaddr_in addr = { .sin_family = AF_INET, .sin_port = htons(self.port) };
+  addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  if (0 != connect(fd, (struct sockaddr *)&addr, sizeof(addr))) {
+    close(fd);
+    return nil;
+  }
+  send(fd, payload.bytes, payload.length, 0);
+  NSMutableData *received = [NSMutableData data];
+  char chunk[4096];
+  NSDate *deadline = [NSDate dateWithTimeIntervalSinceNow:timeout];
+  while (deadline.timeIntervalSinceNow > 0) {
+    ssize_t n = recv(fd, chunk, sizeof(chunk), 0);
+    if (n > 0) {
+      [received appendBytes:chunk length:(NSUInteger)n];
+      // The server keeps the connection open after a success, so don't wait the full timeout
+      // for an EOF that never comes.
+      struct timeval drainTv = { .tv_sec = 0, .tv_usec = 200000 };
+      setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &drainTv, sizeof(drainTv));
+    } else {
+      break;
+    }
+  }
+  close(fd);
+  return [[NSString alloc] initWithData:received encoding:NSUTF8StringEncoding] ?: @"";
+}
+
+- (void)testRequestForAlreadyAbandonedSessionIsRejectedImmediately
+{
+  // A request parsed *after* DELETE /session tore the session down never receives an abandonment
+  // notification of its own, so before this was tracked it queued on the route queue -
+  // potentially forever, if that queue is wedged behind the very request that made the client
+  // delete the session in the first place.
+  RouteResponse *abandonedResponse = [RouteResponse new];
+  [abandonedResponse respondWithString:@"session-was-deleted"];
+  [self.server abandonPendingRequestsForSessionID:@"dead-session" withResponse:abandonedResponse];
+
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[@"GET /session/dead-session/probe HTTP/1.1\r\n\r\n" dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0];
+  XCTAssertTrue([response containsString:@"session-was-deleted"], @"%@", response);
+  XCTAssertEqual(atomic_load(&gSessionProbeHits), 0, @"the route must not run for a deleted session");
+}
+
+- (void)testAbandonedSessionIsRememberedAfterManyLaterAbandonments
+{
+  // Abandoned ids are kept for the server's lifetime; evicting them would let a stale request
+  // queue on a possibly wedged route queue again, which is the hang this rejection prevents.
+  RouteResponse *abandonedResponse = [RouteResponse new];
+  [abandonedResponse respondWithString:@"session-was-deleted"];
+  [self.server abandonPendingRequestsForSessionID:@"dead-session" withResponse:abandonedResponse];
+  for (NSUInteger index = 0; index < 64; ++index) {
+    RouteResponse *otherResponse = [RouteResponse new];
+    [otherResponse respondWithString:@"other-session-was-deleted"];
+    [self.server abandonPendingRequestsForSessionID:[NSString stringWithFormat:@"other-session-%lu", (unsigned long)index]
+                                       withResponse:otherResponse];
+  }
+
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[@"GET /session/dead-session/probe HTTP/1.1\r\n\r\n" dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0];
+  XCTAssertTrue([response containsString:@"session-was-deleted"], @"%@", response);
+  XCTAssertEqual(atomic_load(&gSessionProbeHits), 0, @"the route must not run for a deleted session");
+}
+
+- (void)testRequestForLiveSessionIsStillServed
+{
+  // The rejection above must be scoped to the abandoned identifier only.
+  RouteResponse *abandonedResponse = [RouteResponse new];
+  [abandonedResponse respondWithString:@"session-was-deleted"];
+  [self.server abandonPendingRequestsForSessionID:@"dead-session" withResponse:abandonedResponse];
+
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[@"GET /session/live-session/probe HTTP/1.1\r\n\r\n" dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0];
+  XCTAssertTrue([response containsString:@"session-probe-ok"], @"%@", response);
+  XCTAssertEqual(atomic_load(&gSessionProbeHits), 1);
+}
+
+@end

package/drivers/ios/WebDriverAgent/WebDriverAgentTests/UnitTests/FBHTTPServerTests.m

@@ -0,0 +1,264 @@
+/**
+ * Copyright (c) 2015-present, Facebook, Inc.
+ * All rights reserved.
+ *
+ * This source code is licensed under the BSD-style license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+#import <XCTest/XCTest.h>
+
+#import <arpa/inet.h>
+#import <stdatomic.h>
+#import <sys/socket.h>
+#import <unistd.h>
+
+#import "FBHTTPServer.h"
+
+static atomic_int gFramingProbeHits;
+
+// Exercises FBHTTPServer's HTTP framing defenses with raw socket data that URL-loading APIs
+// cannot produce: malformed Content-Length values and header blocks that never terminate.
+@interface FBHTTPServerTests : XCTestCase
+@property (nonatomic, strong) FBHTTPServer *server;
+@property (nonatomic, assign) uint16_t port;
+@end
+
+@implementation FBHTTPServerTests
+
+- (void)setUp
+{
+  [super setUp];
+  atomic_store(&gFramingProbeHits, 0);
+  self.server = [FBHTTPServer new];
+  [self.server handleMethod:@"POST" withPath:@"/framing/probe" block:^(RouteRequest *request, RouteResponse *response) {
+    atomic_fetch_add(&gFramingProbeHits, 1);
+    [response respondWithString:@"probe-ok"];
+  }];
+  [self.server get:@"/framing/ping" withBlock:^(RouteRequest *request, RouteResponse *response) {
+    [response respondWithString:@"pong"];
+  }];
+  self.server.port = 0;
+  NSError *error;
+  XCTAssertTrue([self.server start:&error], @"%@", error);
+  self.port = [[self.server valueForKeyPath:@"socket.port"] unsignedShortValue];
+}
+
+- (void)tearDown
+{
+  [self.server stop:NO];
+  self.server = nil;
+  [super tearDown];
+}
+
+// Sends `payload` as-is and reads until the server closes the connection or `timeout` elapses.
+// Returns everything received (nil on connect failure); *didClose reports whether EOF was seen.
+- (NSString *)responseForRawPayload:(NSData *)payload timeout:(NSTimeInterval)timeout didClose:(BOOL *)didClose
+{
+  *didClose = NO;
+  int fd = socket(AF_INET, SOCK_STREAM, 0);
+  if (fd < 0) {
+    return nil;
+  }
+  int noSigpipe = 1;
+  setsockopt(fd, SOL_SOCKET, SO_NOSIGPIPE, &noSigpipe, sizeof(noSigpipe));
+  struct timeval tv = { .tv_sec = (long)timeout, .tv_usec = 0 };
+  setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+  struct sockaddr_in addr = { .sin_family = AF_INET, .sin_port = htons(self.port) };
+  addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  if (0 != connect(fd, (struct sockaddr *)&addr, sizeof(addr))) {
+    close(fd);
+    return nil;
+  }
+  // send(2) may write only part of the payload, which would truncate the multi-KiB flood
+  // payloads into something the server answers differently. Errors stay ignored on purpose:
+  // those same tests expect the server to close the connection mid-send.
+  const uint8_t *bytes = payload.bytes;
+  size_t remaining = payload.length;
+  while (remaining > 0) {
+    ssize_t sent = send(fd, bytes, remaining, 0);
+    if (sent <= 0) {
+      break;
+    }
+    bytes += sent;
+    remaining -= (size_t)sent;
+  }
+  NSMutableData *received = [NSMutableData data];
+  char chunk[4096];
+  NSDate *deadline = [NSDate dateWithTimeIntervalSinceNow:timeout];
+  while (deadline.timeIntervalSinceNow > 0) {
+    ssize_t n = recv(fd, chunk, sizeof(chunk), 0);
+    if (n == 0) {
+      *didClose = YES;
+      break;
+    }
+    if (n < 0) {
+      // A read timeout. Only stop waiting once the response is a keep-alive success, where no
+      // EOF is ever coming; every other response precedes a close, and giving up here would
+      // report didClose = NO for a connection the server is about to drop.
+      NSString *soFar = [[NSString alloc] initWithData:received encoding:NSUTF8StringEncoding] ?: @"";
+      if ([soFar containsString:@"HTTP/1.1 200"]) {
+        break;
+      }
+      continue;
+    }
+    [received appendBytes:chunk length:(NSUInteger)n];
+    // The response has started arriving; poll in short slices from here so a keep-alive success
+    // doesn't sit out the whole timeout waiting for an EOF that never comes.
+    struct timeval drainTv = { .tv_sec = 0, .tv_usec = 200000 };
+    setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &drainTv, sizeof(drainTv));
+  }
+  close(fd);
+  return [[NSString alloc] initWithData:received encoding:NSUTF8StringEncoding] ?: @"";
+}
+
+- (void)testWellFormedRequestStillSucceeds
+{
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[@"GET /framing/ping HTTP/1.1\r\n\r\n" dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"200"], @"%@", response);
+  XCTAssertTrue([response containsString:@"pong"], @"%@", response);
+}
+
+- (void)testNonNumericContentLengthIsRejected
+{
+  // Under -integerValue's lenient parsing "bogus" became 0: the probe route would run with an
+  // empty body and the smuggled GET below would be answered as a second pipelined request.
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nContent-Length: bogus\r\n\r\nGET /framing/ping HTTP/1.1\r\n\r\n";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertFalse([response containsString:@"pong"], @"the smuggled request must not be answered: %@", response);
+  XCTAssertTrue(didClose, @"the connection must be closed after unparseable framing");
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0, @"the route must not be dispatched with unknown body extent");
+}
+
+- (void)testWhitespaceBeforeHeaderColonIsRejected
+{
+  // RFC 7230 (3.2.4): whitespace between a field name and its colon MUST be rejected with a 400.
+  // Tolerating it stores "content-length " as a distinct key, dispatches the request with a
+  // zero-length body, and re-parses the declared body as a smuggled pipelined request.
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nContent-Length : 5\r\n\r\nhello";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertTrue(didClose);
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0);
+}
+
+- (void)testHeaderLineWithoutColonIsRejected
+{
+  // Silently skipping the malformed line made this dispatch with an empty body while "hello"
+  // stayed in the buffer to be parsed as the next request.
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nContent-Length 5\r\n\r\nhello";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertTrue(didClose);
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0);
+}
+
+- (void)testDuplicateContentLengthIsRejected
+{
+  // RFC 7230 (3.3.3): repeated framing fields are unrecoverable. Last-wins assignment would let
+  // the second value drive parsing while an intermediary used the first - a smuggling primitive.
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nContent-Length: 5\r\nContent-Length: 0\r\n\r\nhello";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertTrue(didClose);
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0);
+}
+
+- (void)testEmptyTransferEncodingIsRejected
+{
+  // "chunked" followed by an empty value: with last-wins assignment plus a non-empty presence
+  // check, the empty value used to make the header look absent, so the chunked body was parsed
+  // as a zero-length body and its bytes re-read as smuggled requests.
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: \r\n\r\n0\r\n\r\n";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"] || [response containsString:@"501"], @"%@", response);
+  XCTAssertTrue(didClose);
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0);
+}
+
+- (void)testPipelinedRequestsAreServedInOrder
+{
+  // Two requests in one payload: both must be answered on the same connection. Guards the
+  // response backpressure logic - the next pipelined request is only processed once the
+  // previous response's send completed, which must not stall or reorder the pipeline.
+  NSString *payload = @"GET /framing/ping HTTP/1.1\r\n\r\nGET /framing/ping HTTP/1.1\r\n\r\n";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  NSUInteger pongCount = [response componentsSeparatedByString:@"pong"].count - 1;
+  XCTAssertEqual(pongCount, 2, @"both pipelined requests must be answered: %@", response);
+}
+
+- (void)testPartiallyNumericContentLengthIsRejected
+{
+  NSString *payload = @"POST /framing/probe HTTP/1.1\r\nContent-Length: 5abc\r\n\r\nhello";
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:5.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertTrue(didClose);
+  XCTAssertEqual(atomic_load(&gFramingProbeHits), 0);
+}
+
+- (void)testOversizedHeaderBlockIsRejected
+{
+  // A header block that never terminates: 96 KiB of header lines with no \r\n\r\n. The server
+  // must stop buffering and close the connection instead of growing the buffer indefinitely.
+  NSMutableString *payload = [NSMutableString stringWithString:@"GET /framing/ping HTTP/1.1\r\n"];
+  NSString *filler = [@"X-Filler: " stringByAppendingString:[@"" stringByPaddingToLength:1013 withString:@"a" startingAtIndex:0]];
+  while (payload.length < 96 * 1024) {
+    [payload appendString:filler];
+    [payload appendString:@"\r\n"];
+  }
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:10.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertTrue(didClose, @"the connection must be closed rather than left buffering");
+}
+
+- (void)testOversizedCompletedHeaderBlockIsRejected
+{
+  // Same flood, but properly terminated with \r\n\r\n. Depending on how the bytes coalesce, the
+  // terminator can arrive in the same receive callback as the bulk of the block, in which case
+  // the incomplete-header cap never fires - the completed block must be rejected too instead of
+  // being copied and parsed.
+  NSMutableString *payload = [NSMutableString stringWithString:@"GET /framing/ping HTTP/1.1\r\n"];
+  NSString *filler = [@"X-Filler: " stringByAppendingString:[@"" stringByPaddingToLength:1013 withString:@"a" startingAtIndex:0]];
+  while (payload.length < 96 * 1024) {
+    [payload appendString:filler];
+    [payload appendString:@"\r\n"];
+  }
+  [payload appendString:@"\r\n"];
+  BOOL didClose;
+  NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[payload dataUsingEncoding:NSUTF8StringEncoding]
+                                            timeout:10.0
+                                           didClose:&didClose];
+  XCTAssertTrue([response containsString:@"400"], @"%@", response);
+  XCTAssertFalse([response containsString:@"pong"], @"the oversized request must not be served: %@", response);
+  XCTAssertTrue(didClose, @"the connection must be closed rather than left buffering");
+}
+
+@end